Entitlement Management

Microsoft Entra Entitlement Management is the Identity Governance feature for packaging access to apps, groups, SharePoint sites, and Teams into access packages that users can request through a self-service catalog. Each package has policies — who can request, who approves, how long access lasts, requirements like training completion, periodic recertification. Replaces the pattern of "email IT for access to X" with a structured request-and-approval workflow that's audited end-to-end. Often used for project-based access (joining a project gets you the relevant package, leaving removes everything at once), partner / contractor onboarding, and regulatory recertification. Part of Microsoft Entra ID Governance licensing.

Access packages, catalogs, and policies

An access package is the unit a user actually requests — bundling one or more resource roles (group membership, a Teams team, a SharePoint site's Member role, an application's assigned role) that together represent "everything a person in this situation needs," rather than making them request each resource individually and hope nothing was missed. Access packages live inside a catalog, which groups related packages and their resources together, and each package can have multiple policies governing different requester populations — for example, one policy for internal employees requesting through the corporate identity, and a separate policy with a different (typically stricter) approval chain for external users requesting the same package as guests.

Worked example

A consulting firm runs client engagements that each need a dedicated SharePoint site, a Teams team, and a security group controlling access to a shared reporting Power BI workspace. Rather than IT manually provisioning all three per engagement, an access package is created bundling the site's Member role, the Teams team's membership, and the security group's membership. When a new engagement starts, the engagement lead requests the package for each team member, routed to the practice manager for approval; access is granted with an expiration tied to the engagement's expected end date and a requirement to re-request if the engagement is extended. When the engagement ends and access expires, all three resources are removed from every team member simultaneously — no separate offboarding steps per system, and no orphaned SharePoint or Teams access lingering after the engagement's Power BI workspace access was manually cleaned up (or, more realistically, wasn't).

Access reviews and lifecycle

Entitlement Management integrates directly with Entra ID access reviews: a package's policy can require periodic recertification (e.g., every 90 days, the requester's manager confirms access is still needed) rather than assuming a one-time approval remains valid indefinitely. This is the mechanism that keeps project-based and partner access from silently becoming permanent — a package granted for a six-month engagement that somehow runs long still forces an explicit re-approval rather than just continuing unnoticed.

Common pitfalls

The most common early mistake is building access packages that mirror existing ad-hoc access too literally — bundling an overly broad set of resources into one package because that's what an admin happened to grant manually in the past, rather than reassessing what a role genuinely needs. The second is neglecting to set an expiration or recertification policy at all, which reproduces the exact standing-access problem Entitlement Management exists to solve, just with a nicer request form in front of it.