JUMP TO SECTIONChoose a lesson section
Access needs a lifecycle, not just an approval.
Authentication answers who you are. Authorization answers what you can do. Governance answers a harder question: should you still be able to do it, and who is accountable? Identity governance connects requests, approvals, access reviews, privileged elevation and removal into a traceable process.
Request. Review. Elevate.
Entitlement management, access reviews and PIM solve different parts of the access lifecycle. They're related, but one doesn't replace the others.
Entitlement management
Who needs which resources for how long?Bundle supported group, app and SharePoint resource roles in a catalog-backed package. Use policies to control who can request it, approvals, assignment duration and reviews.
Access reviews
Does someone still require the access they have?Ask the right reviewer, evaluate business need and record Approve or Deny decisions. Apply results at the review's end, automatically or manually as configured.
Privileged Identity Management
Who may hold powerful permissions right now?Make an identity eligible to activate a privileged role, enforce role-specific verification, justification, approval and time limits, and review activation evidence.
Package the access, not the exceptions.
Northstar brings on a contractor for a six-week project. They need one Teams group, one SharePoint site and a SaaS application. Rather than issuing three indefinite manual grants, an administrator defines a catalog-backed access package with the required resource roles.
The package's assignment policy can limit who may request access, define approval and justification requirements, set a duration and control reviews. The result is an assignment with a clear reason to exist—and a planned end. An access package is different from an enterprise application collection; it's a governed resource bundle, not just a way to organize a list.
Catalog
Organizes related resources and access packages and provides a boundary for delegated owners and catalog creators.
Resource roles
Defines exactly which supported group, Teams, SharePoint site or enterprise-app roles the package provides.
Assignment policy
Controls which internal or external identities may request the package, how approvals work and whether assignments expire.
Request & approval
Captures the requester, justification, sponsor or approver, approval outcome and resulting assignment.
Review & expiration
Limits access in time, reassesses continued need and removes assignments according to the configured lifecycle.
For external collaborators, connected organizations and requester restrictions help prevent a project-specific package from becoming an open invitation to anyone. Define the right sponsor, approver, expiration and offboarding process. An external identity's presence in Entra doesn't by itself justify access to every Northstar resource.
A reviewer saying “Deny” isn't the same as access being gone.
Imagine a quarterly review shows a former Finance employee still holding Finance-App membership. A reviewer must investigate whether the permission is still needed, record a decision and allow the configured review process to apply the outcome. The review end date and auto-apply settings matter: submitting a decision early does not necessarily revoke access immediately.
Which users and access?
Choose the exact access package, group, application or role assignment. Consider guests, inactive people and overly broad rights.
Who knows the business need?
A manager, application owner, sponsor or approved reviewer must be positioned to decide. Review recommendations are decision support, not unquestionable proof.
When should it recur?
Choose review frequency and duration appropriate to the risk. Governance isn't a one-time cleanup.
What if nobody decides?
A configured default decision controls nonresponses. A safe setting depends on the sensitivity and continuity requirements.
When does access change?
Submitting decisions is not necessarily enforcement. Outcomes are applied after review completion via automatic application or administrator action.
Did the access actually end?
Compare applied decisions, group or package assignments, downstream resources and audit records; account for propagation or service-specific behavior.
Review configuration can define what happens when a reviewer never responds, including leaving access unchanged, removing access or following recommendations. For sensitive resources, evaluate that default up front. Don't assume silence always removes or retains access.
What happens after a Deny—or no response?
Deny submitted on day two.
A reviewer denies Finance-App access during a ten-day review. That decision is recorded, but access generally changes after the review ends. Auto-apply may apply it then; otherwise an administrator must apply the result.
Verify: Review end date, auto-apply setting, applied status, actual membership and application access. For an urgent departure, use the approved immediate offboarding workflow rather than waiting for a review.Every reviewer misses the deadline.
The configured nonresponse decision governs users who received no decision: no change, remove access, approve access or take recommendations. An automatic removal setting with auto-apply can cause an unexpectedly broad revocation.
Verify: Default decision, scope, reviewer coverage, impact of no responses, and approved rollback. Pilot with a controlled population before scheduling recurring reviews.The guest is denied access. Is the whole account removed?
For supported guest-only review configurations, an administrator can choose to remove membership from the reviewed resource, or block the guest's sign-in and subsequently remove the B2B account after a 30-day recovery period.
Verify: Which guest action was selected and whether the business intends resource-level removal or tenant-level offboarding. The two outcomes are not interchangeable.Eligible is not active. Pending is not approved.
A technician can be eligible for a privileged role without holding it continuously. When a real task requires elevation, they request activation. PIM evaluates the role's policy, which may require stronger authentication, an incident ticket, justification, approval and a maximum activation duration. A successful approved activation creates temporary active privilege. When it ends, the active assignment is removed, though specific services may cache earlier authorization.
A role's actual settings vary. Not every eligible role requires the same approval workflow, and an identity may already have a separate active assignment. Always inspect the specific scope and effective privileges rather than treating a PIM state as universal.
PIM for Microsoft Entra roles
An engineer becomes eligible for Security Administrator for an approved identity-security change.
Configure role policy, approvers, duration, justification and applicable authentication controls; validate the resulting active role.PIM for Azure resource roles
An engineer activates Contributor on a specific resource group rather than Owner on an entire subscription.
Azure RBAC governs Azure management operations and can have distinct policy settings from Entra directory roles.PIM for Groups
A technician temporarily activates membership in a group that grants supported privileged or application access.
Group membership and ownership are governed independently; the rights ultimately depend on what the group is assigned.Check the requester, least-privileged role, scope, ticket, reason and proposed duration against the authorized work. Under Microsoft's current Entra role-approval workflow, requests requiring approval expire if they aren't approved within 24 hours; that is not a customizable review queue. Always follow the active tenant policy and current Microsoft guidance.
PIM for Groups: being a member and being an owner are different activations
May activate membership—not every role in Entra.
Northstar makes a technician eligible to join an application-support group for a limited window. The group must itself be assigned the correct app or resource privileges; activating membership does not independently grant Global Administrator.
Verify: Member activation policy, approval and MFA requirements, actual active membership, resource assignment and effective rights after activation.May activate group ownership, not automatic resource access.
Ownership can permit supported group-management operations. Membership and ownership have separate PIM policies and can require different approvers, justification and activation duration.
Verify: Whether the operation needs membership or ownership, role-assignable status and which administration path can change the group outside PIM.Not every group can participate.
Dynamic groups and groups synchronized from on-premises cannot be managed through PIM for Groups. Groups in restricted management AUs also have governance limitations. Downstream app provisioning may add delay between group activation and real access.
Verify: Group type, source of authority, license, PIM eligibility and observed app-side entitlement before promising immediate access.For a privileged change, confirm approved ticket, appropriate PIM scope, requested role (or group membership/ownership), activation state, resulting resource permission and evidence of deactivation afterward. An eligible assignment or submitted request is not proof of effective privilege.
Make the access decision. Then defend it.
Try three Northstar investigations: approve an external access package, complete a sensitive access review, and handle a privileged activation. Set the controls, validate the design and inspect the resulting evidence. Every outcome is simulated in your browser.
Make the decision. Verify the access.
Give access a beginning and an end.
Northstar's external analyst needs a SharePoint project site, a security group, and a SaaS app for 45 days. A sponsor must approve the request.
What if the control you're relying on is unavailable?
Emergency access is intentionally different from ordinary PIM. Microsoft recommends maintaining at least two cloud-only emergency Global Administrator accounts with permanent active role assignments, phishing-resistant authentication, tested recovery procedures and tight monitoring. They should not rely on federation or Conditional Access policies that could block emergency sign-in. These accounts are for genuine recovery—not a shortcut around approvals.
Who is eligible or assigned? What role/resource scope is involved? Is the change approved? What is the request reason, ticket and allowed window?
Which activation policy applies? Was required verification completed? Was approval actually granted? Is the assignment Active rather than Pending?
When did activation end? Which privileged actions were performed? Did a resource cache previous authorizations? Are audit and review records retained?
Diagnose the governance boundary first
A user submits a PIM activation request, then begins privileged work immediately.
What to check: Submitted is not Active. An approval-dependent activation may remain Pending. Check effective role assignment and request state first.
An access reviewer selects Deny and immediately assumes a departing consultant has been locked out.
What to check: The review may still be running. Confirm completion, automatic/manual application, resulting assignment and actual access.
A security group uses PIM, so an engineer assumes membership grants Global Administrator.
What to check: PIM for Groups only governs membership/ownership activation. The group's specific role or resource assignment determines its privileges.
The primary identity provider is unavailable and administrators cannot activate PIM.
What to check: Use a separately governed emergency-access design. Microsoft recommends at least two cloud-only, permanent active Global Administrator emergency accounts with phishing-resistant authentication, monitoring and periodic tests.
A project sponsor approves a package that contains every Finance resource, though a consultant needs one report.
What to check: Revise the resource scope before approval. A fast workflow doesn't repair an excessive authorization grant.
Microsoft Entra PIM requires qualifying P2 or ID Governance licensing; entitlement management and access reviews have their own licensing and guest requirements. This simulator doesn't need those licenses because it runs locally and makes no Microsoft API calls. Verify licensing before designing a real deployment.
Practice 013 now includes a simulated governance workbench. Deliver a time-limited access package, apply a deny review, and verify a new assignment expires. Then activate a scoped eligible PIM role and prove privilege disappears after the activation window. Finally, test an independently secured emergency-access path during a simulated administration outage.
Open the Governance & PIM Lifecycle Simulator →Apply the reasoning here. Verify the implementation with Microsoft.
Role settings, review behavior and license entitlements change. Microsoft's current documentation remains the source for configuring production policies. Use this guide and Practice 013 to strengthen judgment without requiring an administrator account or exposing a real tenant.
Can you approve access without creating a permanent exception?
Keep the original flashcards and tickets, then configure and validate the approval, expiration, PIM activation and emergency-access lifecycles.