Identity Governance, Privileged Access, and Identity Protection

radio_button_uncheckedshort_text Introduction

For decades, administering identities mainly meant creating accounts in a directory, adding users to groups, and removing access when someone left the company. This model worked better when systems were concentrated in a local network and organizational changes happened at a relatively predictable pace. The expansion of the cloud, remote work, software as a service, and collaboration with partners transformed this scenario: a single person can accumulate access to dozens of applications, teams, sites, subscriptions, and administrative roles.

It was in this context that identity governance consolidated as a discipline. Its purpose is to continuously answer four questions: who has access, to what, for what reason, and for how long. The answer cannot depend only on spreadsheets or the memory of administrators. It must be sustained by policies, automation, approvals, reviews, and audit evidence.

For the reader, understanding this topic means seeing identity as a living process. A correctly created account can become risky months later if the person changes roles, accumulates permissions, or remains with permanent administrative privilege. For society, better governance practices reduce leaks, fraud, disruptions, and data misuse, strengthening trust in public and private digital services.

Guiding question

Is the most dangerous problem an attacker with no access or a legitimate user who received too much access, for too long, and without review? Throughout the chapter, we will see that both risks meet at the same layer: identity.

radio_button_uncheckedshort_text 1. From account administration to identity governance

Identity administration is the set of operational tasks used to create, change, enable, disable, and delete identities. Identity governance is broader: it defines how access should be requested, approved, granted, reviewed, expired, and evidenced. In other words, administration answers “how to execute”; governance answers “why, under which policy, and with what evidence”.

Governance connects areas that were previously treated separately: human resources, security, technology, audit, compliance, and business owners. HR knows the employment relationship and the person's dates; the manager knows the role; the resource owner knows the sensitivity; security knows the risk; the identity platform applies the controls. When these signals are integrated, access can follow the reality of the organization.

radio_button_uncheckedshort_text 2. Microsoft Entra ID Governance

Microsoft Entra ID Governance is the set of Microsoft Entra capabilities intended to control the lifecycle of identities and access. The goal is to increase productivity without losing security: new employees need to start with the right resources; people who change areas need to receive new access and lose the old; offboardings require quick removal; guests and vendors need scoped access; administrators need to elevate privilege only when necessary.

The capabilities most relevant to the SC-900 are Lifecycle Workflows, access reviews, entitlement management , and Privileged Identity Management. They complement each other. Workflows automate lifecycle-driven tasks. Access packages organize resources and policies. Reviews verify whether access is still needed. PIM governs privileged roles and groups. Provisioning, terms of use, reports, and logs reinforce the solution.

SC-900 focus

The exam usually assesses the purpose of each feature. Access review recertifies; entitlement management organizes and automates entitlements; PIM controls privilege; ID Protection detects and remediates risk.

radio_button_uncheckedshort_text 3. Joiner-Mover-Leaver lifecycle

The Joiner-Mover-Leaver model, often abbreviated as JML, describes three essential phases of the relationship between an identity and the organization. Joiner is the entry; Mover is a relevant change; Leaver is the exit. The value of the model is in treating access changes as a consequence of business events, and not as isolated requests that can be forgotten.

3.1 Joiner: onboarding and first-day preparation

In the Joiner phase, the organization receives reliable data about the new person, creates their identity, and prepares resources. This can include account, groups, license, team, application, device, initial credential, training, and acceptance of terms. A mature process avoids two extremes: the employee arriving without access and losing productivity, or receiving generic and excessive access “to make sure it works”.

3.2 Mover: change of role, manager, or location

Mover is the most neglected phase. Promotion, transfer, project change, leave, or change of employment relationship may require new access. The common error is adding the new without removing the old, generating privilege creep, or the progressive accumulation of privileges. Governance should recalculate what is necessary, apply separation of duties when relevant, and start additional reviews for sensitive resources.

3.3 Leaver: offboarding and access termination

Leaver requires coordination and speed. Depending on the scenario, the account can be blocked, sessions and tokens revoked, roles and groups removed, application access deprovisioned, devices collected, and data transferred. Immediately deleting the account is not always the first appropriate action, because the organization may need to preserve a mailbox, files, logs, or evidence. The principle is to prevent misuse without destroying information needed for continuity and compliance.

radio_button_uncheckedshort_text 4. Lifecycle Workflows

Lifecycle Workflows are governance capabilities that automate tasks associated with the JML phases. A workflow combines scope, trigger, and tasks. The scope defines who will be affected; the trigger defines when execution occurs; the tasks define what will be performed. An example is sending a message to the manager seven days before the hire date and, on the first day, enabling the account and adding the user to an initial group.

Workflows can run on demand or on a schedule when the conditions are met. Attributes such as hire date, leave date, department, and employee type help select identities. For more complex scenarios, extensions can integrate external processes. Run history and audit logs allow verifying what ran, for whom, and with which result.

Best practice

Automation does not eliminate responsibility. Incorrect HR attributes or poorly defined rules can automate the error at scale. Therefore, source data, testing, piloting, and monitoring are parts of governance.

radio_button_uncheckedshort_text 5. Access reviews

An access review is a recertification process: someone evaluates whether users, guests, or identities still need to keep a certain access. The review can cover groups, applications, access packages and, in privileged scenarios, roles. It can be one-time or recurring and can delegate the decision to the manager, the resource owner, specific reviewers or, in some cases, the user themselves.

The reviewer usually chooses to approve or deny continuation. Suggestions and context help the decision, but they do not replace business knowledge. At the end, the results can be applied to remove denied or unreviewed access, according to the configuration. The value of a review is not only in producing a report: it is in reducing unnecessary access and generating evidence that the organization controls its permissions.

5.1 What can be reviewed

• Groups: members of security or Microsoft 365 groups can be recertified.
• Applications: assignments of users to enterprise applications can be evaluated.
• Guests: B2B access can be reviewed and removed when the collaboration ends.
• Access packages: assignments granted by entitlement management can have periodic reviews.
• Privileges: Microsoft Entra roles, Azure resource roles, and PIM -managed groups can be reviewed.

5.2 Decisions and automation

A review must define frequency, duration, reviewers, reminders, behavior for no response, and application of results. “No response” is not a universal synonym for approval or denial; it depends on the chosen policy. For high-impact access, the absence of a decision usually requires conservative handling and follow-up.

radio_button_uncheckedshort_text 6. Entitlement management and access packages

Entitlement management automates how identities request, receive, keep, and lose access to sets of resources. Instead of processing separate requests for each group, application, or site, the organization creates an access package that represents a business need, such as “Project Atlas”, “Audit vendor”, or “Regional marketing team”.

An access package can include memberships to groups and teams, application roles, and SharePoint site roles. The package sits in a catalog, which organizes resources and delegates their administration. One or more policies determine who can request or receive the package, whether approval is required, who approves, how long the access is valid, whether there are questions or terms, and whether reviews will be performed.

6.1 Essential components

6.2 Request, approval, expiration, and review

The flow can be by request, direct assignment, or automatic rule, depending on the scenario. The policy can require approval in one or more stages and collect justifications. The duration can be defined by date, number of days, or another supported window. Before or during expiration, a review can confirm continuation. When the entitlement ends, the service removes the related assignments, reducing guest accounts and forgotten permissions.

Essential difference

An access package grants a governed set of entitlements. An access review asks whether the entitlement should continue. A Lifecycle Workflow performs tasks on lifecycle events. The three features can work together.

radio_button_uncheckedshort_text 7. Privileged access and administrative risk

Privileged access is the ability to perform actions that change security, identity, configuration, data, or availability of systems. Accounts with administrative roles are valuable targets because a single compromise can affect the entire organization. Even without an external attack, standing privileges increase the chance of error, abuse, or use outside the process.

The principle of least privilege determines that each identity receives only the necessary permissions, in the necessary scope, and for the necessary time. In administrative roles, this leads to two complementary ideas. Just-in-Time grants the privilege only when the task needs to be executed. Just-Enough-Access limits the set of actions to the minimum sufficient. PIM mainly materializes the first principle through eligibility and temporary activation, while reinforcing the second with appropriate roles and scopes.

radio_button_uncheckedshort_text 8. Microsoft Entra Privileged Identity Management

Microsoft Entra Privileged Identity Management, or PIM , is a service to manage, control, and monitor privileged access to Microsoft Entra roles, Azure resource roles, and memberships or ownership of PIM -enabled groups. Instead of keeping all administrators permanently active, the organization can make them eligible . The person remains authorized to request the role, but the privilege only becomes active after an activation flow.

8.1 Eligible , active, permanent, and time-bound

8.2 Activation flow

When activating a role, the user selects a duration within the configured limit and provides a justification. Depending on the role policy, it may be necessary to perform MFA, satisfy a Conditional Access policy, provide a ticket number, or wait for approval. After approval and activation, the role is available for the defined window. When the period ends or deactivation occurs, active access is removed and the event remains logged.

8.3 Controls and evidence

• Approval: one or more approvers evaluate the need before activation.
• MFA and Conditional Access: reinforce verification at the moment of elevating privilege.
• Justification and ticket: record the business reason and link the activity to a process.
• Maximum duration: limits how long the role can remain active.
• Notifications and alerts: report activations, permanent assignments, and situations considered insecure.
• History and audit: allow investigating who activated, when, for how long, and under which justification.
• Access reviews: recertify privileged eligibilities and assignments over time.

Exam pitfall

PIM is not the same as Azure RBAC. RBAC defines which actions a role allows and in which scope. PIM governs when and under which conditions a privileged assignment becomes active.

radio_button_uncheckedshort_text 9. Microsoft Entra ID Protection

Microsoft Entra ID Protection helps detect, investigate, and remediate identity-based risks. The service analyzes signals and behaviors to identify suspicious events. These risks can feed reports, investigations, and Conditional Access policies, allowing the access decision to adapt to the context instead of relying only on a correct password.

9.1 Risk detection, sign-in risk , and user risk

A risk detection is evidence or behavior considered suspicious, such as leaked credentials or use of an anonymous IP address. Sign-in risk is the probability that a specific authentication request was not made by the legitimate owner. User risk is the probability that the identity is compromised, considering evidence associated with the user. The first is tied to the session; the second represents the broader state of the account.

9.2 Examples of detections

Not every detection means confirmed compromise. The service assigns levels and provides context for investigation. Some detections are calculated in real time, during sign-in; others are calculated offline after additional correlation. The administrator must distinguish true positive, false positive, and unusual legitimate activity.

radio_button_uncheckedshort_text 10. Risk-based remediation policies

Risk levels can be used in Conditional Access policies. For sign-in risk , a common response is to require MFA or an adequate authentication strength. For user risk , the policy can require risk remediation, such as a secure password change, or block access when the organization cannot accept the exposure. The modern configuration concentrates these decisions in Conditional Access, integrating ID Protection with the grant controls.

10.1 Leaked credentials and hash synchronization

In hybrid identities, the detection of leaked credentials requires that relevant password hashes are available for comparison through password hash synchronization. This does not mean that the plaintext password is synchronized. The mechanism works with derived and protected material. For the SC-900, the important conceptual relationship is: without the necessary synchronization, the service may not be able to correlate leaked credentials of hybrid users with the current on-premises password.

10.2 Anonymous IP and context

An anonymous IP address can be used by an attacker, but also by someone using a private network or privacy service. Therefore, the detection must be combined with other signals: device, location, history, authentication method, and resource sensitivity. Zero Trust neither presumes trust nor automatic condemnation; it verifies explicitly and responds proportionally to the risk.

Key idea

ID Protection detects and classifies risk. Conditional Access turns risk into a decision. MFA, password change, block, and investigation are possible responses.

radio_button_uncheckedshort_text 11. Governance, privilege, and protection: how they connect

Governance responds to expected access; protection responds to suspicious behavior; PIM controls administrative elevation. A person can be correctly assigned to an access package but present sign-in risk and be challenged by MFA. An administrator can have legitimate eligibility but need approval and justification to activate the role. A guest can have valid access today and lose it automatically at the next review or expiration.

This integration avoids two insufficient models. The first is static: grant access once and trust indefinitely. The second is purely reactive: wait for an incident to remove permissions. The mature approach combines prevention, time limitation, continuous review, risk signals, and audit evidence.

radio_button_uncheckedshort_text 12. Microsoft Entra Verified ID

Microsoft Entra Verified ID is a service for issuing and verifying verifiable credentials. The idea is to allow an organization to issue a signed digital claim, for the person to keep that credential in a wallet, and to present it to another organization or application when they need to prove something. The verifier validates authenticity, integrity, and status of the credential without depending on an account previously created in the same directory as the issuer.

12.1 Issuer, holder, and verifier

• Issuer: organization that creates and signs the credential, such as a university, employer, or certifying entity.
• Holder: person or entity that receives, controls, and presents the credential.
• Verifier: organization or application that requests a proof and validates the presented credential.

12.2 A verifiable credential is not a visual badge

The value is not in the appearance of a card, but in the signed and verifiable claims. A credential can prove a relationship, qualification, training, or authorization. Open standards, digital signatures, and decentralized identifiers allow verifying who issued it and whether the content was altered. The holder presents only the necessary proof according to the solution design, favoring control and data minimization.

12.3 Example

An outsourced company completes mandatory security training and receives a verifiable credential. When requesting access to an environment, the professional presents the credential. The verifier confirms that it was issued by the trusted entity, is valid, and matches the request. After that, access can proceed to approval or granting by other controls. Verified ID provides verifiable proof; it does not by itself replace authorization, RBAC, or Conditional Access.

radio_button_uncheckedshort_text 13. Microsoft Entra and Microsoft Security Copilot

Microsoft Security Copilot combines generative artificial intelligence with Microsoft's security data and capabilities. In the context of Microsoft Entra, it can help administrators explore risky sign-ins and users, summarize context, suggest investigation steps, query information about users and groups, and support governance tasks. There are also experiences aimed at Lifecycle Workflows, access reviews, and governance optimization.

The integration reduces the time spent reading logs and preparing queries, but it does not transfer responsibility to the AI. Responses must be validated, permissions need to follow least privilege, and high-impact actions require human confirmation. A convincing summary may be incomplete; a suggestion may not consider a business exception. Copilot is an analysis accelerator, not an autonomous source of authority.

radio_button_uncheckedshort_text 14. Integrated practical scenario

Consider Contoso Health, which hires employees, temporary doctors, and vendors. The goal is to reduce manual requests and prevent access from remaining after the end of the relationship.

14.1 Onboarding

The HR system records the hire date and the department. A Lifecycle Workflow sends guidance before the first day, enables the account on the correct date, and adds the employee to a basic group. For a vendor, entitlement management offers the “Vendor - Clinical Project” package, with a Teams group, a ticketing application, and a documents site. The policy allows requests only from a connected organization, requires sponsor approval, and limits access to 90 days.

14.2 Change of role

An analyst is promoted to coordinator. The workflow updates lifecycle tasks and the new role requires access to reports. A review confirms the previous access; incompatible permissions are removed to avoid accumulation. She receives eligibility in PIM for a limited administrative role. When she needs to perform a task, she requests activation for one hour, performs MFA, provides the ticket, and waits for approval.

14.3 Risk event

ID Protection detects a sign-in from an anonymous IP and unusual properties. The sign-in risk triggers Conditional Access, which requires strong authentication. At another time, leaked credentials raise the user's risk; the policy requires remediation and a secure password change. The team uses Security Copilot to summarize signals and prepare the investigation, but confirms the logs before concluding that there was a compromise.

14.4 Offboarding

When the contract ends, the leave date triggers the workflow. The account is blocked, sessions are revoked, and access is removed. The package assignment expires and the guest does not keep permissions. Logs and review results demonstrate to the audit that access was granted, used, and removed under a defined policy.

Scenario outcome

No capability solves everything on its own. Security emerges from the composition: lifecycle + packages + reviews + PIM + risk detection + access policies + audit.

radio_button_uncheckedshort_text 15. Comparisons that tend to appear on the SC-900

radio_button_uncheckedshort_text 16. Quick review for the exam

• Identity governance controls who has access, to what, why, and for how long.
• Joiner-Mover-Leaver represents entry, change, and exit; Mover is crucial to avoid privilege accumulation.
• Lifecycle Workflows automate tasks using scope, trigger, and actions.
• Access reviews recertify access and can remove unnecessary permissions.
• Entitlement management uses catalogs, resources, packages, and policies to govern requests and assignments.
• PIM offers Just-in-Time privileged access, eligible assignments, temporary activation, approval, MFA, justification, alerts, and audit.
• Sign-in risk refers to a specific authentication; user risk refers to the possibly compromised identity.
• Leaked credentials, anonymous IP, and atypical travel are examples of detections; an isolated signal requires context.
• Conditional Access policies can require MFA, risk remediation, password change, or block.
• Verified ID works with issuer, holder, and verifier; the credential is signed and verifiable.
• Security Copilot helps with investigation and governance, but does not replace human validation.

radio_button_uncheckedshort_text Conclusion

Governance, privilege, and identity protection form a logical sequence. First, the organization defines and automates the expected access throughout the Joiner-Mover-Leaver cycle. Then, it reviews and expires entitlements to prevent accumulation. Next, it limits administrative privilege with eligibility and temporary activation. Finally, it observes risk signals and adapts the access decision when the identity or the session seem compromised.

In my assessment, this is one of the most important chapters of the SC-900 because it transforms isolated products into a coherent strategy. The central point is not to memorize portals, but to recognize which problem each capability solves. A mature organization does not ask only “is the password correct?”. It asks whether the person should have the access, whether they still need it, whether the privilege should be active now, and whether there are signs that the identity is no longer trustworthy.

The natural next step is to study how artificial intelligence, investigation, and automation extend security operations. By mastering this chapter, the reader begins to see each access as a temporary, contextual, and verifiable decision - exactly the mindset required by Zero Trust and modern identity security.

radio_button_uncheckedshort_text Practice questions

1. A company wants administrators to have a role available only when they need to perform a task, requiring MFA, justification, and approval. Which feature best fits the scenario?

• A) Microsoft Entra Verified ID
• B) Microsoft Entra Privileged Identity Management
• C) Microsoft Entra Connect Sync
• D) Microsoft Defender for Cloud Apps

Comment

Correct answer: B. PIM allows eligible assignment and temporary activation with controls such as MFA, justification, approval, duration, and audit.

2. Which option correctly describes sign-in risk and user risk ?

• A) Both represent exactly the same state.
• B) Sign-in risk evaluates a specific request; user risk evaluates the probability that the identity is compromised.
• C) User risk exists only for guests.
• D) Sign-in risk defines RBAC permissions.

Comment

Correct answer: B. Sign-in risk is tied to the authentication session; user risk represents the broader state of the identity.

3. An organization wants to offer vendors a set of groups, applications, and sites for 60 days, with sponsor approval. Which capability is the most appropriate?

• A) Entitlement management with an access package and an assignment policy
• B) Only an access review
• C) Only a permanent role in Azure RBAC
• D) Microsoft Entra ID Protection

Comment

Correct answer: A. An access package brings resources together, while the policy defines eligibility, approval, duration, and review.

4. What is the main role of an access review ?

• A) Create a verifiable credential.
• B) Synchronize password hashes.
• C) Recertify whether identities still need to keep access and apply removals when necessary.
• D) Automatically activate all privileged roles.

Comment

Correct answer: C. Access reviews verify the continued need for access and can apply changes to remove unnecessary permissions.

radio_button_uncheckedshort_text Essential glossary

radio_button_uncheckedshort_text Official references for further study

• Microsoft Learn. Study guide for Exam SC-900: Microsoft Security, Compliance, and Identity Fundamentals.
• Microsoft Learn. Describe the identity protection and governance capabilities of Microsoft Entra.
• Microsoft Learn. Microsoft Entra ID Governance overview; Lifecycle Workflows; Access Reviews; Entitlement Management.
• Microsoft Learn. What is Microsoft Entra Privileged Identity Management?; PIM deployment and role settings.
• Microsoft Learn. What is Microsoft Entra ID Protection?; risk detections; risk-based access policies and remediation.
• Microsoft Learn. Microsoft Entra Verified ID documentation and architecture overview.
• Microsoft Learn. Security Copilot in Microsoft Entra and Identity Governance scenarios.

Material prepared for educational purposes. Names, features, interfaces, and licensing requirements may evolve; for implementation, always consult the most recent official documentation.