Somebody who left in March still has access to something, and nobody will find it until an auditor asks.
Entra ID Governance automates joining, moving and leaving, packages access so business owners approve it rather than IT guessing, reviews entitlements on a schedule, and removes guests when their access expires. It answers four questions Microsoft states plainly, and most organisations can answer none of them.
- Joiner, mover, leaverAutomated from your HR source
- Access packagesApproved by owners, not IT
- GuestsRemoved automatically on expiry
- AuditableControls an auditor can verify
Eight capabilities, organised around the three lifecycles.
Identities created from your HR system, not from a ticket
Inbound provisioning from HR sources, with Microsoft naming Workday and SuccessFactors, maintains user identities in both Active Directory and Microsoft Entra ID automatically. The signal that somebody has joined comes from the system that already knows, which is the only version of onboarding that stays accurate. It also means the leaver signal is equally automatic, and leavers are where the risk actually is.
Lifecycle workflows at the moments that matter
Workflows run at key events: before a new employee is scheduled to start, when their status changes during employment, and when they leave. Microsoft gives a concrete example of sending an email containing a temporary access pass to a new user manager, or a welcome email to the user, on their first day. The mover event is the one organisations forget, and it is where access quietly accumulates.
Access packages, so the right person decides
Entitlement management lets you define how identities request access across packages of group and team memberships, application roles and SharePoint Online roles. The decision moves from IT, who cannot know whether a request is reasonable, to the manager, department lead or resource owner, who can. That single shift is usually the largest practical improvement the product delivers.
Separation of duties, enforced at request time
Entitlement management can enforce separation of duties checks on access requests, which means an incompatible combination is prevented at the point of request rather than discovered during an audit. Microsoft describes multi-stage approval too, giving the example of access to confidential customer data requiring a manager, a resource owner and a security risk officer.
Guests who arrive and leave without anybody chasing
You can specify which other organisations may request access. An approved requester is added automatically as a B2B guest and assigned appropriate access, and Microsoft is explicit that entitlement management automatically removes the B2B guest from your directory when their access rights expire or are revoked. For UAE organisations working with contractors, consultants and partner firms, this closes the gap that never closes manually.
Access reviews with AI assistance for the reviewers
Recurring reviews confirm people still need what they hold, and Microsoft states that AI-powered suggestions help reviewers make better informed decisions, including AI-identified peer outliers that may warrant higher scrutiny. That last point addresses the real failure of manual reviews, which is that a manager faced with two hundred rows approves all of them in one click.
Privileged access as part of the same picture
Privileged Identity Management sits inside this family, providing just-in-time access and role change alerting across Entra roles, Microsoft 365 roles, Azure resource roles and group memberships, with access reviews providing recurring recertification for everybody in a privileged administrator role. Governing ordinary access and administrative access through one model is considerably easier to evidence than two disconnected processes.
AI agent identities, currently in preview
Microsoft has extended governance to AI agent identities, and labels this preview. Every agent identity requires a human sponsor accountable for its purpose, lifecycle decisions and access reviews, and if that sponsor leaves the organisation sponsorship transfers automatically to their manager. Agents are governed through the same access packages as people. Microsoft states the aim directly: preventing agent sprawl and shadow AI.
Microsoft states four questions. Try answering them about your own organisation.
These are quoted from the Microsoft overview, and they are a better diagnostic than any feature list. If you cannot answer them, the gap is exactly what this product exists to close.
- Which identities should have access to which resources? Not which ones do, which ones should. In most organisations the answer lives in the memory of whoever set it up, and the two lists have drifted apart over years.
- What are those identities doing with that access? Which requires that access be visible, attributable and reviewable, rather than dissolved into a nested group structure that nobody has fully resolved.
- Are there organisational controls in place for managing access? Meaning a defined process with an owner and a decision point, not a habit that depends on a particular person remembering.
- Can auditors verify that the controls are working effectively? This is the question that separates a policy from a control. A written procedure that produces no evidence fails this test, and it is the one that generates audit findings.
Four things that keep a governance project from becoming a two year programme.
We start with leavers and guests, not with a target model
The leaver path and the guest lifecycle are where the actual risk sits, they are the easiest to automate, and they produce a visible result within weeks. Designing a complete role model first is how these projects consume a year without delivering anything, and the model is usually wrong by the time it is finished anyway.
We package a handful of applications properly rather than all of them badly
Entitlement management works when access packages reflect real business roles with real owners who understand what they are approving. Three or four well-designed packages covering genuinely sensitive access outperform forty packages assembled from existing group names, which simply moves the existing mess into a new interface.
We design reviews that reviewers can actually complete
A review presenting two hundred rows to a manager gets approved in bulk and evidences nothing. We scope reviews to what a person can genuinely assess, use the AI suggestions and peer outlier identification the platform provides, and set a cadence that survives more than one cycle. A review that happens twice a year and is real beats a quarterly one that is theatre.
We build for the auditor who will ask
Microsoft fourth question is whether auditors can verify the controls work, and that is the one that generates findings. We configure so that a completed review, a request approval chain and a deprovisioning record can be produced on demand, because that is the evidence an ISO 27001 auditor, a SOC 2 examiner or a client questionnaire actually asks for.
Six UAE situations where manual access management has already failed.
Professional services with constant external collaboration
Consultancies, law firms and agencies bring in contractors and client-side users continuously, and almost never remove them. Entitlement management adds approved external requesters as B2B guests and removes them automatically when access expires or is revoked, which is the only version of this that stays accurate without somebody chasing it every month.
A regulated firm facing access management findings
Banks, finance companies, insurers and DIFC or ADGM entities are examined on how access is granted, changed, removed and recertified. The platform produces evidence for each of those as a by-product of operating normally, rather than requiring somebody to assemble a pack in the fortnight before an examination.
A group that has acquired companies
Multiple HR systems, multiple directories, and no consistent view of who has access to what across the combined estate. Provisioning from authoritative sources and packaging access by business role is how that becomes governable, and it is considerably cheaper than the alternative of discovering the gaps during due diligence on the next acquisition.
High-turnover operations
Construction, hospitality, logistics and retail move large numbers of people in and out continuously, and manual deprovisioning does not survive that volume. Automating the leaver path from the HR signal is the single highest-value change available, and it is usually the first thing we implement because the risk is concrete and the fix is contained.
Education, with an annual cycle nobody enjoys
Cohorts arrive and depart on a calendar, staff change roles between terms, and external examiners and visiting faculty need time-limited access. Lifecycle workflows tied to the academic calendar and access packages with defined expiry replace an annual scramble that consumes the IT team for weeks and still leaves accounts behind.
An organisation starting to deploy AI agents
Agent identity governance is in preview, and it is worth understanding now rather than after the sprawl. Every agent identity requires a human sponsor accountable for its purpose and access reviews, sponsorship transfers to the manager if the sponsor leaves, and blueprints allow an entire class of agents to be governed, disabled or revoked in one operation. Microsoft names the risk it addresses directly: agent sprawl and shadow AI.
How access is actually managed in most UAE organisations.
| Feature | Governance automated | Manual and documented | Ad hoc |
|---|---|---|---|
Joiners provisioned from an authoritative source | Yes | No | No |
Movers have old access removed | Yes | Rarely | No |
Leavers fully deprovisioned across applications | Yes | Partly | No |
Access approved by the business owner | Yes | Sometimes | No |
Separation of duties enforced at request | Yes | No | No |
Guests removed automatically on expiry | Yes | No | No |
Recurring access reviews with real evidence | Yes | Partly | No |
Privileged access governed in the same model | Yes | No | No |
An auditor can verify the controls work | Yes | Partly | No |
Frequency in the UAE market | Uncommon | Common | Common in SMEs |
What gets governed, and what usually goes wrong without it.
| Lifecycle stage | The usual failure without governance | |
|---|---|---|
| Joiner | Access assembled from a ticket and a guess at what a similar person has | |
| Mover | New access granted, old access kept, permissions accumulate for years | |
| Leaver | Accounts disabled, application access and group memberships left behind | |
| Guest access | Partner accounts persist long after the project that justified them | |
| Access requests | IT approves, having no basis on which to judge the request | |
| Separation of duties | Incompatible combinations found by an auditor, not prevented | |
| Recertification | A spreadsheet, approved in bulk, evidencing nothing | |
| Privileged access | Permanent, unreviewed and held by more people than anyone believes | |
| AI agent identities | Created ad hoc, unsponsored, unreviewed and multiplying |
Five steps, with something working in the first month.
- 1
Establish the current state against the four questions
Who has access to what, how it was granted, what controls exist and what evidence they produce. This is a short exercise and it establishes the gap concretely, which is what turns a governance conversation from abstract into fundable.
- 2
Automate the leaver path first
The highest risk and the most contained piece of work. A leaver signal from the authoritative source triggering removal of access across the applications that matter, rather than an account disabled while application entitlements persist. This alone closes the finding most auditors raise.
- 3
Bring the guest lifecycle under entitlement management
Specify which external organisations may request access, define what they can request and for how long, and let the platform add and remove B2B guests automatically as access is granted and expires. Visible, quick, and it addresses a population that is almost never reviewed manually.
- 4
Package a small number of applications with real owners
Three or four access packages covering genuinely sensitive access, with approval routed to the person who can actually judge the request, and separation of duties checks where incompatible combinations exist. Then extend, once the model has proven itself on something real.
- 5
Turn on reviews and connect the joiner path
Recurring access reviews scoped so reviewers can complete them honestly, using the AI suggestions and peer outlier identification the platform provides. Then HR-driven provisioning for joiners and movers, which is the largest piece of work and is best attempted once the rest is running.
What organisations ask about Entra ID Governance.
Fifteen questions worth answering first.
What is manual today
- How does IT learn that somebody has joined?If the answer is an email, that is the first gap.
- How does IT learn that somebody has changed role?The mover event is the one nobody handles.
- How does IT learn that somebody has left?And how long after their last day.
- Who approves an access request today?If it is IT, they are guessing.
- How are guest accounts removed?In most tenants, they are not.
What to automate first
- Do you have an HR system that could be the source?Microsoft names Workday and SuccessFactors among others.
- Which applications hold access worth packaging?Start with a few high-value ones, not everything.
- Do you work with external firms regularly?Guest lifecycle is often the quickest visible win.
- Are there combinations that must never co-exist?Separation of duties can be enforced at request time.
- Do you use non-Microsoft applications?Connectors cover many via SCIM, LDAP and SQL.
The audit driver
- Has an auditor asked how access is granted and removed?This is usually what starts the project.
- Can you evidence a completed access review?Evidence, not an assertion that one happened.
- Are you pursuing ISO 27001 or SOC 2?Both examine access provisioning and recertification directly.
- Do clients send you security questionnaires?Access lifecycle questions appear in nearly all of them.
- Have you confirmed licensing?It requires Entra ID Governance or Entra Suite licensing.
The pages around this one.
Access rights review
The point-in-time review across all your systems, and the usual first step before automating anything.
Privileged Identity Management
The privileged access half of the same model: just-in-time elevation, approval and downloadable audit history.
ISO 27001 certification
The standard whose access control requirements this platform is unusually well suited to evidencing.
Start with everybody who left in the last twelve months.
Then check what they still have access to across your applications, not just whether the account is disabled. That exercise takes a day, it is uncomfortable in a useful way, and it decides whether this work is urgent or merely sensible.
Related Services
Explore more solutions that work great with this service
Access Rights Review
Certification that removes access, not one that gets approved
Privileged Identity Management
Just-in-time admin access, approval, and audit history you can download
ISO 27001 Certification UAE
The 2022 edition, and whether you should certify at all
Microsoft Entra
Identity and access management solutions
Entra ID P1 vs P2
What P2 genuinely adds, and what quietly moved
IT General Controls
What your external auditor tests, and the evidence they sample
SOC 2 Readiness UAE
Type II preparation, and when ISO 27001 fits better
Microsoft Security Dubai
Entra, Defender, Purview, Sentinel, and what you already own