Entra ID access packages: ending "please add me to the group" requests by email
In many organisations, access to a team, a SharePoint site or an application is granted through an email to the service desk and then never removed. Entra ID entitlement management turns these requests into a traceable process with an end date.
The problem with hand-granted access
A manual group addition leaves a single line in the audit log, with no justification and no end date. As people change roles they accumulate rights that no longer match their job, and external guests remain members of projects that ended long ago. This is exactly what entitlement management is designed to fix.
The building blocks
- Catalog: a container of resources (groups, teams, applications, SharePoint sites) delegated to a business owner;
- Access package: a coherent bundle of resources and roles, for example "Project Alpha – contributor";
- Policy: who can request, who approves, for how long, and which questions are asked;
- Assignment: the result, dated and justified, visible in reports.
The feature requires Entra ID P2 or Entra ID Governance, with some options (custom extensions or attribute-based automatic assignments, for instance) being Governance-only. The exact split evolves, so check it for your tenant.
Design useful policies
A well-designed policy answers four questions. Who is eligible: a department, all employees, a partner organisation? Who approves: the manager, the resource owner, or both in two stages? How long does access last: a fixed date or a number of days, with or without extension? And should assignments be subject to a periodic access review? Asking for a justification at request time costs little and greatly improves the quality of the record.
Good practice. Set an expiry on every policy, even a long one. Access without an end date is just the manual model with an extra form.
External users and connected organisations
Connected organisations declare a partner (by its Entra ID tenant or its domain) whose users can request an access package from the My Access portal. On approval, the guest account is created automatically. More importantly, external user lifecycle settings can block sign-in and then delete the guest when their last assignment expires. This is one of the most effective ways to contain guest account sprawl.
Migrating from ad-hoc requests
- list the groups and teams most frequently requested through the service desk;
- bundle resources by business need rather than by system;
- appoint a catalog owner for each area;
- publish the My Access link and gradually close the email route;
- then review historical group members who were added outside the process.
In short
Access packages are not just a convenience. For every right they record a requester, an approver, a justification and an end date. That is precisely what auditors look for when they assess access management, and what is most often missing in the tenants we analyse.