Governance & Lifecycle Governance & Lifecycle

Referenz für Access Reviews, Entitlement Management, Lifecycle Workflows, Terms of Use und Administrative Units. Reference for access reviews, entitlement management, lifecycle workflows, terms of use, and administrative units.

Governance & Lifecycle Überblick Governance & lifecycle overview

Identity Governance in Entra bündelt Recertification, Zugriffsanfrage, Lifecycle-Automatisierung und administrative Delegation. Ziel ist nicht nur Compliance, sondern auch bessere Datenqualität und schnellere Prozesse. Identity governance in Entra combines recertification, access requests, lifecycle automation, and administrative delegation. The goal is not only compliance, but also better data quality and faster processes.

Access Reviews Access reviews

Access Reviews können für Gruppen, Enterprise Apps, App-Rollen, PIM-Rollen und Zugriffspakete erstellt werden. Reviewer können Besitzer, Manager, ausgewählte Benutzer oder die Betroffenen selbst sein. Access reviews can be created for groups, enterprise apps, app roles, PIM roles, and access packages. Reviewers may be owners, managers, selected users, or the users themselves.

• Auto-apply entfernt nach Abschluss nicht bestätigten Zugriff automatisch. Auto-apply automatically removes unconfirmed access after completion.
• Recommendations basieren auf letzter Anmelde- oder Zugriffsaktivität. Recommendations are based on last sign-in or access activity.
• Fallback-Reviewer sind wichtig, wenn Eigentümer fehlen oder deaktiviert sind. Fallback reviewers are important when owners are missing or disabled.

            
                $body = @{
                  displayName = "Quarterly Review - HR App"
                  scope = @{
                    query = "/groups/<group-id>/transitiveMembers"
                    queryType = "MicrosoftGraph"
                  }
                  reviewers = @(
                    @{
                      query = "/users/<reviewer-id>"
                      queryType = "MicrosoftGraph"
                    }
                  )
                  settings = @{
                    autoApplyDecisionsEnabled = $true
                    defaultDecisionEnabled = $false
                    instanceDurationInDays = 14
                    recurrence = @{
                      pattern = @{ type = "absoluteMonthly"; interval = 3 }
                      range = @{ type = "noEnd"; startDate = "2026-01-01" }
                    }
                  }
                } | ConvertTo-Json -Depth 10
                
                Invoke-MgGraphRequest -Method POST `
                  -Uri "https://graph.microsoft.com/beta/identityGovernance/accessReviews/definitions" `
                  -Body $body `
                  -ContentType "application/json"
                        
            
        

Entitlement Management Entitlement management

Entitlement Management strukturiert Ressourcen in Kataloge und Zugriffspakete. Richtlinien steuern, wer anfragen darf, ob eine Genehmigung nötig ist, wie lange der Zugriff gilt und welche Reviews greifen. Entitlement management organizes resources into catalogs and access packages. Policies control who may request access, whether approval is needed, how long access lasts, and which reviews apply.

• Nutze Access Packages statt einzelner Einladungen für wiederkehrende Partnerprozesse. Use access packages instead of one-off invitations for recurring partner processes.
• Auto-assignment eignet sich für definierte Populationen über Attribute oder Gruppen. Auto-assignment works well for defined populations through attributes or groups.
• Kataloge sollten einem klaren Owner und Governance-Prozess zugeordnet sein. Catalogs should be tied to a clear owner and governance process.

Lifecycle Workflows Lifecycle workflows

Lifecycle Workflows automatisieren joiner, mover und leaver Prozesse. Auslöser können z. B. Eintrittsdatum, Austrittsdatum, Managerwechsel oder Gruppenregeln sein. Lifecycle workflows automate joiner, mover, and leaver processes. Triggers can include hire date, termination date, manager change, or group-based conditions.

            
                Invoke-MgGraphRequest -Method GET `
                  -Uri "https://graph.microsoft.com/beta/identityGovernance/lifecycleWorkflows/workflows"
                        
            
        

Terms of Use Terms of use

Terms of Use dokumentieren die Akzeptanz von Richtlinien, NDAs oder Datenschutztexten. Die Erzwingung erfolgt typischerweise über Conditional Access, sodass Benutzer bei erstem Zugriff zustimmen müssen. Terms of use document acceptance of policies, NDAs, or privacy statements. Enforcement typically happens through Conditional Access, requiring users to accept on first access.

Administrative Units Administrative units

Administrative Units begrenzen die Verwaltungsreichweite von Rollen. Sie sind hilfreich für regionale Support-Teams, getrennte Marken oder Bildungseinrichtungen mit föderierter Administration. Administrative units limit the management scope of roles. They are useful for regional support teams, separate brands, or education environments with delegated administration.

            
                # Administrative Unit anlegen
                $body = @{
                  displayName = "AU - Germany"
                  description = "Scoped administration for Germany"
                } | ConvertTo-Json
                
                Invoke-MgGraphRequest -Method POST `
                  -Uri "https://graph.microsoft.com/v1.0/directory/administrativeUnits" `
                  -Body $body `
                  -ContentType "application/json"
                        
            
        

PowerShell + Graph PowerShell + Graph

            
                # Access Review Definitionen lesen
                Invoke-MgGraphRequest -Method GET `
                  -Uri "https://graph.microsoft.com/beta/identityGovernance/accessReviews/definitions"
                
                # Access Packages inventarisieren
                Invoke-MgGraphRequest -Method GET `
                  -Uri "https://graph.microsoft.com/beta/identityGovernance/entitlementManagement/accessPackages"
                
                # Administrative Units anzeigen
                Invoke-MgGraphRequest -Method GET `
                  -Uri "https://graph.microsoft.com/v1.0/directory/administrativeUnits"
                        
            
        

Lifecycle Workflows Deep DiveLifecycle Workflows deep dive

Lifecycle Workflows automatisieren Joiner-, Mover- und Leaver-Prozesse rund um Benutzerkonten. Wertvoll wird das Feature erst dann, wenn Trigger, Scope, Genehmigungen und Built-in Tasks sauber kombiniert werden.Lifecycle Workflows automate joiner, mover, and leaver processes around user accounts. The feature becomes truly valuable only when triggers, scope, approvals, and built-in tasks are combined cleanly.

Built-in Tasks im ÜberblickBuilt-in tasks overview

Trigger, Bedingungen und ScopeTriggers, conditions, and scope

Entitlement Management Deep DiveEntitlement Management deep dive

Entitlement Management bündelt Ressourcen in Katalogen, verteilt sie über Access Packages und ergänzt den Lebenszyklus durch Freigabe, Ablauf und Review. Richtig eingesetzt ist es das Bindeglied zwischen Self-Service und Governance.Entitlement Management bundles resources into catalogs, distributes them through access packages, and extends the lifecycle with approval, expiration, and review. Used correctly, it becomes the bridge between self-service and governance.

Policy-Design mit Genehmigung und EskalationPolicy design with approval and escalation

Connected Organizations, Auto-Assignment und ErweiterungenConnected organizations, auto-assignment, and extensions

Connect-MgGraph -Scopes "EntitlementManagement.Read.All"

Invoke-MgGraphRequest -Method GET `
  -Uri "https://graph.microsoft.com/beta/identityGovernance/entitlementManagement/accessPackages?$top=50"

Invoke-MgGraphRequest -Method GET `
  -Uri "https://graph.microsoft.com/beta/identityGovernance/entitlementManagement/catalogs?$top=50"