Skip to main content

Microsoft 365 identity governance controls who has access to what, for how long, and with what evidence. Microsoft Entra ID Governance covers three areas: the identity lifecycle (joiners, movers, leavers), the access lifecycle (access packages and access reviews) and privileged access (PIM). Each feature has its own license requirement.

Key Facts

  • Entra ID Governance addresses four questions: which identities should have access to which resources, what they do with that access, whether organizational controls manage it, and whether auditors can verify them (Microsoft Learn, accessed 2026-10-27).
  • Three scenarios: govern the identity lifecycle, govern the access lifecycle, and secure privileged access for administration (Microsoft Learn, accessed 2026-10-27).
  • Lifecycle workflows require Microsoft Entra ID Governance; Privileged Identity Management needs Entra ID P2 or Entra ID Governance (Microsoft Learn, accessed 2026-10-27).
  • Microsoft states no new identity governance and administration features will be added to the Entra ID P2 SKU (Microsoft Learn, accessed 2026-10-27).

Last updated by Errin O'Connor, Founder & Chief AI Architect, EPC Group

The direct answer

Identity governance is the part of Microsoft 365 governance that decides who gets access to which resources, keeps that access current as people join, change roles and leave, and produces the evidence an auditor asks for. In a Microsoft 365 tenant it runs on Microsoft Entra ID Governance, which Microsoft describes as making sure the right people have the right access to the right resources through process automation, delegation to business groups and visibility.

The three areas and their features

AreaWhat it governsMicrosoft Entra featuresLicense (per Microsoft Learn)
Identity lifecycleAccounts created when people join, changed when they move, removed when they leaveHR-driven provisioning, lifecycle workflowsHR provisioning: P1 and above; lifecycle workflows: Entra ID Governance
Access lifecycleWhich groups, Teams, apps and SharePoint sites each person can use, and for how longEntitlement management (access packages), access reviewsCore capabilities: P2; advanced capabilities: Entra ID Governance
Privileged accessAdministrator roles, granted just in time and reviewedPrivileged Identity Management (PIM)Entra ID P2 or Entra ID Governance

How EPC Group sets it up

  1. Map current licenses to the features needed, so nothing is bought twice or missing.
  2. Automate joiners, movers and leavers from the HR system, starting with removal of access when people leave.
  3. Put guests and privileged roles under recurring access reviews.
  4. Move access requests into access packages with approvals and expiry.
  5. Hand over reporting for auditors: who has access, who approved it, and when it was last reviewed.

Identity governance is one pillar of a wider Microsoft 365 governance program; see the Microsoft 365 governance framework and Microsoft Entra ID services.

Primary sources

Frequently Asked Questions

Is Microsoft Entra ID P2 enough for identity governance?

EPC Group checks the feature list before buying. Microsoft Entra ID P2 includes Privileged Identity Management and the access reviews and entitlement management capabilities that were previously in P2, but lifecycle workflows require Microsoft Entra ID Governance, and Microsoft states no new identity governance features will be added to the P2 SKU (Microsoft Learn, accessed 2026-10-27).

Which Microsoft 365 plans include Entra ID P1 or P2?

EPC Group maps licenses first: Microsoft documents that Entra ID P1 is included with Microsoft 365 E3, E5 or E7 and Microsoft 365 Business Premium, and Entra ID P2 with Microsoft 365 E5 or E7. Microsoft Entra ID Governance is an add-on that requires P1 or P2 in the tenant (Microsoft Learn, accessed 2026-10-27).

Do guests count for Entra ID Governance licensing?

EPC Group plans guest governance separately. Microsoft licenses governance for guest users on a monthly active user basis, which requires an Azure subscription to be selected for guest billing, unlike the per-user licensing for employees (Microsoft Learn, accessed 2026-10-27).

Where should an organization start with identity governance?

EPC Group usually starts with the joiner-mover-leaver process, because access that is never removed is the most common audit finding: automate account creation and removal from the HR system, then add access reviews for guests and privileged roles, then move access requests into access packages.

Talk to a senior architect

A one-hour scoping call with a senior EPC Group architect covers your licenses, your joiner-mover-leaver process and which access needs review first. Email contact@epcgroup.net or call 888-381-9725.

Documented and anonymized engagements

Named engagements come first; anonymized summaries follow under the anonymized-engagement rule — the client is not named and every statement is EPC-reported. Documents behind named engagements are in the Evidence Center.

More engagements: Prairie View A&M University (Texas A&M University System) — Gmail to Exchange Online migration services (2020) · Georgia Institute of Technology (Georgia Tech Professional Education) — Microsoft Teams and SharePoint consulting services (2019) · Haskell (The Haskell Company) — Office 365 Phase 0 implementation-strategy initiative (2017) · Google Workspace and Microsoft 365 into One Tenant (2023) · Office 365 Tenant Consolidation: Four into One (2023) · Cross-Tenant Migration After an Acquisition: Life Sciences

All case studies →

AI assistant — not a human