Configure Microsoft Entra ID Governance Entitlement Management Access Packages

Configure Microsoft Entra ID Governance Entitlement Management Access Packages

Microsoft Entra ID Governance has many cool features, one of them is Entitlement Management. Within Entitlement Management is the Access Packages feature.

Access Packages allow you to configure user self-service access to groups, applications, or SharePoint sites. You can set an Access Package to use a specific approver or a dynamic one, such as the user’s manager. You can also configure access reviews to help address users having access to things they no longer need.

An example use case for an Access Package is configuring it so a user can request Visio and have their manager approve the request. Once approved, the Access Package adds the user to the Visio licensing group, which allocates them a license. If Intune is configured, the user can then install Visio themselves via Company Portal.

You can delegate the setup of Access Packages for a department to someone in that department, allowing them to self-manage how their department members get the access they need for the projects or tasks they are working on.

In this post, I will show you step by step how to create an Access Package.

Prerequisites

To use the basics of Entitlement Management, including Access Packages, you need the following license.

  • Microsoft Entra ID P2

If you want to unlock all the advanced features of Entitlement Management and Identity Governance, you need to have one of the following licenses.

  • Microsoft Entra ID Governance
  • Microsoft Entra Suite

The Process

  • Login to the Microsoft Entra admin center.
  • Click on ID Governance > Entitlement management.

The rest of the process is divided into the following sections.

Catalogs

Before creating an Access Package, we need to create a Catalog. A Catalog is a collection of resources that Access Packages can use. Catalogs help organize resources and can enable delegated management without excessive permissions.

  • Click on Catalogs.
  • Click on New catalog.
  • Enter a name and description for the catalog.

In my example, I will enter the name as Project Neo and the description as Access to project Neo.

  • For Enabled for users to request, decide if users can request access to the Access Packages within the Catalog.

In my example, I will select Yes.

  • For Enabled for external users to request, decide if external users can request access to Access Packages within the Catalog.

In my example, I will select No.

  • Click Create.
  • Click on the Catalog you just created.

In my example, I will click on the Project Neo catalog I just created.

  • In the Manage section, click on Resources.
…

Read More Read More

Microsoft Entra ID Conditional Access What If

Microsoft Entra ID Conditional Access What If

An underrated feature of Entra ID Conditional Access is the What If tool. The Conditional Access What If tool can help you troubleshoot or design Conditional Access policies.

Typically, when building a Conditional Access policy, you target a test user and then expand testing using report-only mode. Testing can be difficult if the workflow is complex or uncommon. Fortunately, the Conditional Access What If tool lets you simulate logins and policy impacts to test or troubleshoot without logging in multiple times or waiting for changes to propagate and the Entra sign-in logs to populate.

In this post, I will show you step by step how to use the Conditional Access What If tool.

The Process

  • Login to the Microsoft Entra admin center.
  • Click on Entra ID > Conditional Access.
  • Click on Policies.
  • Click on What if.
  • Now we need to configure all the settings for the What If tool.
  • For identity type, select whether to test Users, Guest or external users, Workload identities, or Agent identities.

In my example, I will select Users.

  • Select the identity to simulate a login for.

Depending on which identity type you selected, your options will differ.

In my example, I will select my user account.

…

Read More Read More

Microsoft Entra ID Conditional Access

Microsoft Entra ID Conditional Access

Microsoft Entra ID (formerly Azure AD) has an awesome feature called Conditional Access that can add an extra layer of security to your Microsoft 365 tenant. The power of Conditional Access really shines when you position Entra as your IdP (Identity Provider). Conditional Access is one of my favorite features in Entra.

To use Conditional Access policies, you need an Entra ID P1 or P2 license. Without one, your tenant likely has Security Defaults enabled. Security Defaults is a basic version of Conditional Access that does not allow any customizations. It provides protections, such as requiring all users to register for MFA and prompting for MFA when Microsoft deems it necessary.

The power of Conditional Access is that it lets you use identity signals such as user, location, application, and device, to name a few, and make decisions based on those signals, such as allowing or denying access or requiring additional verification.

Conditional Access processes policies using if-then conditions (not top-to-bottom like a firewall). Conditional Access policies take effect after first-factor authentication is completed (such as entering a valid password).

The best way I’ve found to think about Conditional Access is to compare it to airport security when traveling from Canada to the United States. Before you can board your flight, you need to clear security. If we wrote this as a conditional access policy, it would be: if the user is logging in, then MFA is required.

When traveling to the United States from Canada, you complete customs pre-clearance before boarding your flight. After clearing security, you have to clear U.S. customs. Customs checks whether you have a valid passport and whether you pose a risk to the country. You could technically say that to access customs, you need to clear security and have a valid passport. If we wrote this as a conditional access policy, it would be: if a user wants to log in to the VPN portal, then MFA and a compliant device are required. Since the user just performed MFA, the policy won’t prompt for MFA again, and as long as the device is compliant, it allows the user to log in to the VPN portal. At a high level, that’s how Conditional Access policies work.

Here are a few tips when creating and using Conditional Access policies:

…

Read More Read More

Configure VCF Installer Online Depot

Configure VCF Installer Online Depot

Once you have deployed the VCF Installer, you need to configure a depot connection to access the binaries needed to deploy VCF (VMware Cloud Foundation) or VVF (VMware vSphere Foundation).

In this post, I will show you step by step how to configure an online depot connection for the VCF Installer and download the binaries for VCF or VVF.

Before VCF 9.1, you configured the VCF Installer online depot connection using a download token. In VCF 9.1, the process has changed. You now need to register the VCF Installer in the VCF licensing portal.

Prerequisites

  • VCF Installer deployed.

If you need to learn how, my blog post Deploy VCF Installer details the steps.

  • Internet access on the VCF Installer appliance.

A list of URLs that the VCF Installer needs access to is available from Broadcom here.

The Process

  • Login to the VCF Installer as the admin@local user.
  • In the Get Started section, in the Download Binaries tile, click on Depot Settings and Binary Management.
  • In the Online Depot tile, click on Configure.
  • Copy your Download Service ID.
  • Click on Software Depot Registration.
…

Read More Read More

Deploy VCF Installer

Deploy VCF Installer

When you want to deploy VCF (VMware Cloud Foundation) or VVF (VMware vSphere Foundation), you typically use the VCF installer. Even though the VCF installer has VCF in its name, it can be used to deploy VVF.

In this post, I will show you step by step how to deploy the VCF installer on VMware ESX.

Prerequisites

  • Static IP for the VCF Installer appliance.
  • FQDN for the VCF Installer appliance with forward and reverse DNS records.
  • Enough resources to run the VCF Installer VM.
    • The VCF Installer VM will need:
      • 4 vCPU
      • 16GB RAM
      • 914GB disk space
  • A root password for the VCF Installer appliance.
  • A local user password for the VCF Installer appliance.
  • NTP Servers.

The Process

The entire VCF Installer deployment process is divided into two sections.

Download VCF Installer

Before we can deploy the VCF Installer, we need to download it first.

  • Click on Software > VMware Cloud Foundation > My Downloads.
  • Click on VMware Cloud Foundation or VMware vSphere Foundation.
  • Click VMware Cloud Foundation 9 or VMware vSphere Foundation 9 to expand the releases, then click the release you want.
  • Beside VCF Installer click on View Group.
  • Before you can download anything, you need to read and review the Terms and Conditions and the Compliance Reporting Terms and Conditions.
  • Click on Terms and Conditions to read them.
  • Click on Compliance Reporting Terms and Conditions to read them.
  • After reading, if you agree to the Terms and Conditions and the Compliance Reporting Terms and Conditions, select I agree.
  • Download the VCF SDDC Manager Appliance OVA.

Technically, you are downloading the VCF SDDC (Software Defined Datacenter) Manager.

The SDDC Manager has two purposes:

  1. The VCF Installer for VCF and VVF
  2. The SDDC Manager for VCF.
    • If you deploy the VCF Installer on an ESX host that will be part of your VCF management domain, the VCF Installer will convert into your SDDC Manager.

Deploy VCF Installer

Now that we have the VCF Installer downloaded, we can deploy it.

If you deploy the VCF Installer to an ESX host that will be used for the VCF Management Domain, it will convert to the SDDC Manager and can no longer be used as an installer.

  • To use the VCF Installer, you need to deploy it to something. The following are supported:
    • VMware vCenter
    • VMware ESX
    • VMware Workstation
    • VMware Fusion

In my example, I will deploy the VCF Installer to an ESX host. The process will be similar on other platforms.

  • Login to VMware ESX.
…

Read More Read More

I’m Going to VMware Explore 2026

I’m Going to VMware Explore 2026

I’m super excited that I can attend VMware Explore in Las Vegas this year. The last time I attended VMware Explore was in 2024, and I learned so much. I’m eager to learn even more this year and build on what I’ve learned since last time.

If you want to read about my experience at VMware Explore 2024, check out my blog post I Went to VMware Explore 2024.

If you aren’t familiar with VMware Explore, it used to be called VMworld. VMware Explore is a conference hosted by Broadcom about all things VMware. The main VMware Explore event takes place in Las Vegas, and there’s a smaller version called VMware Explore on Tour, which visits a few different cities. In 2026, VMware Explore on Tour will be at the following locations.

  • Mumbai (September 29th to 30th)
  • Singapore (October 1st to 2nd)
  • Frankfurt (October 13th to 14th)
  • Tokyo (October 20th to 21st)
  • London (November 18th to 19th)
  • Washington, D.C. (December 8th)

VMware Explore in Las Vegas will take place from August 31st to September 3rd.

At VMware Explore in Las Vegas, there are over 250 sessions. Thankfully, the sessions are recorded, as it’s impossible to attend all of them. Here are a few of the sessions I’m planning to attend.

…

Read More Read More

Passing VCP-VCF Architect Exam

Passing VCP-VCF Architect Exam

I recently passed the VCP-VCF Architect exam, specifically the 2V0-13.25 version, and I want to share my experience with the VMware Certified Professional – VMware Cloud Foundation Architect exam.

My VMware Certified Professional – VMware Cloud Foundation Architect Certification

In this post, I will share my experience taking the VCP-VCF Architect exam and studying tips.

Exam Details

The VMware Cloud Foundation Architect 2V0-13.25 exam contains 60 multiple-choice questions, and you have 135 minutes to complete the exam. You need a score of 300 points or higher to pass the exam. The exam may contain unscored questions (you won’t know which questions are unscored).

During the exam, you can flag questions you are unsure about for review, so you can circle back to them before submitting the exam for grading. To help narrow down your choices, you can right-click an answer to add a strikethrough.

The 60 questions you get are pulled from a pool of questions, meaning if two people take the exam, they may not have the same questions.

Studying

The way I prepared for the VCF Architect exam was a bit different from how I prepared for the VCF Admin exam. There was a weekly study session, but unfortunately, there was only one session. The study session was recorded and posted to YouTube. Here is the YouTube playlist of the VCF Architect exam study session.

There’s also an exam guide published by Broadcom, you can find the official exam guide here. The study session covers sections 1 and 2 from the exam guide. I found that the study session was fundamental for preparing me for the exam.

…

Read More Read More

Deploy Horizon Edge Gateway on VMware vSphere

Deploy Horizon Edge Gateway on VMware vSphere

If you have an Omnissa Horizon subscription, you should deploy the Horizon Edge gateway appliance to license your Omnissa Horizon setup.

The Horizon Edge Gateway for vSphere is a VM that you deploy on your VMware vSphere environment. In addition to automatically licensing your Horizon setup, the Horizon Edge gateway also serves as a connector to the Horizon Control Plane hosted by Omnissa, enabling Omnissa and you to monitor your Horizon setup for issues. In older versions of Horizon, the Edge Gateway was called the Cloud Connector.

In this post, I will show you step by step how to deploy the Omnissa Horizon Edge Gateway on VMware vSphere.

Prerequisites

  • Static IP for the Horizon Edge Gateway appliance.
  • FQDN for the Horizon Edge Gateway appliance with forward and reverse DNS records.
  • Enough resources in vSphere for the Edge Gateway VM.
    • The Edge Gateway will need
      • 8 vCPU
      • 16GB RAM
      • 40GB disk
  • A Root password for the Horizon Edge Gateway appliance.
  • An Admin password for the Horizon Edge Gateway appliance.
  • Service Account configured as an admin in Horizon.

If you need to add the service account as an admin to Horizon, my blog post, Add Administrators to Omnissa Horizon covers how to do so.

The Process

  • Under the Launch Services section, click Horizon Cloud.
  • In the Get Started section, in the Horizon 8 tile, click Select.
  • In the Horizon Edge tile, click Start Deployment.
…

Read More Read More

Schedule VMware Exam

Schedule VMware Exam

In this post, I will show you step by step how to schedule a VMware exam.

The Process

The entire process is split into a few stages.

Testing Portal Login

  • In the Additional Resources section, on the Education Portal tile, click Explore.
  • On the new page that opened up under the Addition Resources section, click on Certification.

If you want, you can skip those clicks and go directly to the following URL https://cp.certmetrics.com/vmware/en/home/dashboard

  • Under Features, click on Schedule your exam.
  • Click on SSO to Vue.

Private Access Codes

If you are taking a VMware exam at a conference, you will likely have a private access code to access the on-site exam center.

  • Click Private Access Code, type in the Private Access Code, then click Enter.

Exam Selection

  • Click on View exams.
  • Depending on the exam you are taking, you may need to click on VMware Professional Level Exams or VMware Advanced Level Exams. You can also search for the exam.
…

Read More Read More