Introduction to Microsoft Entra ID Governance deployment guide

Microsoft Entra ID Governance is an identity governance solution to improve productivity, strengthen security, and meet compliance and regulatory requirements. Ensure the right people have the right access to the right resources. Enable identity and access process automation, delegation to business groups, and increased visibility. Mitigate identity and access risk, protect, monitor, and audit access to your assets. Learn more about Microsoft Entra ID Governance use cases and documentation.

Deployment approach

To ensure a comprehensive approach to identity governance, there are phases aligned with the identity lifecycle. Lifecycle automation is the automated processes for user onboarding, role transitions, and offboarding. To assign users to resources entails allocating the right resources to users, integrating entitlements and roles. Secure privileged access helps you protect and manage privileged accounts with access controls and monitoring mechanisms.

In alignment with the approach, the guide has this introduction and four scenarios. Use the links to see each scenario.

While most services are in General Availability (GA), some features or services might be in Public Preview, or other states before GA. GA indicates a product or service is publicly available to all customers and backed by service-level agreement (SLA) guarantees. See the following section for licensing information.

Licensing

Microsoft Entra ID Governance is a feature in Microsoft Entra ID. To enable the deployment, review the following prerequisites.

  • To use Microsoft Entra ID to govern app access, have one of the following license combinations in your tenant: '
    • Microsoft Entra ID Governance and its prerequisite, Microsoft Entra ID P1
    • Microsoft Entra ID Governance Step Up for Microsoft Entra ID P2 and its prerequisite, Microsoft Entra ID P2, or Enterprise Mobility + Security (EMS) E5
    • In the tenant, ensure there’s a license for each governed user (nonguest). Include the users that request access to apps, approve access, or review app access.
  • To govern guest access to the application, link the Microsoft Entra tenant to a subscription for monthly active user (MAU) billing

For more information, see Microsoft Entra ID Governance licensing fundamentals.

Participation model

The recommended participation model for roles to complete tasks and deliverables: responsible, accountable, consulted, and informed (RACI). Use the model to ensure the involved roles understand responsibilities and goals.

  • Responsible - Completes the task
    • Assign at least one Responsible role, although they can delegate
  • Accountable - Assumes responsibility for correctness and completion of work that Responsible delivers
    • The Accountable role delegates tasks and ensures task prerequisites are met
    • Assign one Accountable role for each task or deliverable
  • Consulted - Provides guidance from personal expertise, a subject matter expert (SME)
  • Informed - Receives regular updates on task or deliverable completion

Stakeholders

Stakeholders have an interest in, and influence, project success. The following table has example Microsoft Entra ID Governance deployment stakeholder roles and responsibilities.

Role Expertise Responsibilities
IT Administrator System administration Manage user accounts, maintain system health, troubleshoot technical issues
Business Analyst Requirements and analysis Gather business requirements, analyze workflows, ensure solutions meet organizational needs
End user System usage Use the system as intended, provide feedback on performance and usability

Communications plan

A communications plan helps you proactively interact with your stakeholders and manage expectations.

  • Define the purpose and frequency of communications to stakeholders
  • Determine who creates and distributes communications with mechanisms to share information
  • Provide relevant information about deployment plans and status
  • Explain upcoming changes in the user experience and how users get support

Schedule

A project is a success when you achieve the expected outcomes within budget and time constraints. Therefore, identify result goals by date, quarter, or year. Work with stakeholders for agreement on milestones that define result goals. Clarify success for each goal. Because Microsoft Entra ID Governance and other Microsoft services are in continuous development, map requirements to feature development stages. Set realistic expectations with contingency plans to meet key milestones:

  • Proof-of-concept (PoC)
  • Pilot date
  • Launch date
  • Dates that affect delivery
  • Dependencies

Learn more about Microsoft Entra ID Governance.

In your project schedule:

  • Work breakdown structure with dates, dependencies, critical path, based on subsequent waves of deployment:
    • Maximum number of users for each deployment wave, based on expected support load
    • Time frame for each deployment wave, such as a wave each Monday
    • User groups in each wave and don’t exceed the maximum
    • Apps that users require
  • Team members assigned to tasks

Testing and roll-back

Unanticipated or untested scenarios can negatively affect your users. Create processes to:

  • Test scenarios
  • Enable users to report issues
  • Roll back the deployment
  • Evaluate what went wrong:
    • Identify remediation
    • Communicate to stakeholders
  • Test new configurations

Assessment and discovery

Assessment and discovery establish an understanding of the current state of identity governance, before you deploy Microsoft Entra ID Governance. Create an inventory of current identity governance solutions. Identify gaps and inefficiencies.

  • Identify current state - Document identity governance integrations, policies, workflows, data flows, and apps. Determine edge cases or custom workflows​.
  • Understand the solution - Study and understand Microsoft Entra ID Governance architecture
  • Maintain stakeholder alignment - Identify and align with stakeholders across teams. Ensure agreement on objectives and timelines.

For more information about assessment and discovery, see best practices for securely deploying Microsoft Entra ID Governance

Data collection

Collect current identity governance configuration data to establish an accurate baseline.

  • Entitlements and roles - Current resources, entitlements, roles, their structure, and assignments
  • Access reviews - Plan access review scenarios for users, groups, and levels for apps, access packages, or groups
  • Privileged Identity Management (PIM) - Replicate activation rules, approval workflows, and role eligibility
  • Critical apps and integrations - Apps and systems integrated with the current solution
    • Document migration priorities, based on organizational needs and risks

Best practices and recommendations

A best practice is a tested method or technique that helps deliver higher quality results, over time.