An Access Package is a feature of Entitlement Management within Microsoft Entra ID Governance. With an Access Package, users gain self-service access to groups, applications, or SharePoint sites. You can also configure an Access Package to require approval before access is granted.

The post is a follow-up to my blog post, Configure Microsoft Entra ID Governance Entitlement Management Access Packages, and shows you the workflow for an Access Package.

In this post, I will show each stage of an Access Package, including approvals and views from the user, approver, and admin perspectives.

Prerequisites

• An active Access Package.

If you haven’t set up an Access Package, my blog post Configure Microsoft Entra ID Governance Entitlement Management Access Packages details the entire setup process.

The Process

There are several stages of an Access Package.

• User Request
• First Approval
• Second Approval
• Alternate Approvers
• Approval Not Actioned
• Request Denied
• User Cancel Access Request
• Access Granted
• Access Extend
• Access Review
• Access Ended
• Manual Assignments

User Request

To start the workflow for an Access Package, a user requests access to the Access Package.

• The user goes to https://myaccess.microsoft.com/
• The user clicks My Access > Access packages.

• The user finds the Access Package they want and, under Actions, clicks Request.

• On the Request details tab, the user clicks Continue.

If the user clicks the Resources tab, they can see what resources they will gain access to.

• The user fills in the required details, then they click Submit request.

If the Access Package has an expiry configured and the user enters a longer period, they will receive an error when submitting the request.

If a user does not enter specific period dates, the expiry countdown begins once they have access to the Access Package.

Once a user requests access to an Access Package, they cannot request it again until the request is approved or denied.

From the admin side, go to the Access Package, click Requests, and select the user to view the request details.

First Approval

If the Access Package has approvals configured, the user’s request is sent for approval.

• The first approvers will get an email about the access request.

The email approvers see shows the access start and end times in UTC, and the user’s answers are not visible.

• The first approver clicks the link in the email or goes to https://myaccess.microsoft.com/
• The first approver clicks My Access > Approvals.

• The first approver locates the request and clicks Review.

• The first approver can see some basic information, such as when they are required to make a decision.

…

Read More Read More

Microsoft Entra ID Governance has many cool features, one of them is Entitlement Management. Within Entitlement Management is the Access Packages feature.

Access Packages allow you to configure user self-service access to groups, applications, or SharePoint sites. You can set an Access Package to use a specific approver or a dynamic one, such as the user’s manager. You can also configure access reviews to help address users having access to things they no longer need.

An example use case for an Access Package is configuring it so a user can request Visio and have their manager approve the request. Once approved, the Access Package adds the user to the Visio licensing group, which allocates them a license. If Intune is configured, the user can then install Visio themselves via Company Portal.

You can delegate the setup of Access Packages for a department to someone in that department, allowing them to self-manage how their department members get the access they need for the projects or tasks they are working on.

In this post, I will show you step by step how to create an Access Package.

Prerequisites

To use the basics of Entitlement Management, including Access Packages, you need the following license.

• Microsoft Entra ID P2

If you want to unlock all the advanced features of Entitlement Management and Identity Governance, you need to have one of the following licenses.

• Microsoft Entra ID Governance
• Microsoft Entra Suite

The Process

• Login to the Microsoft Entra admin center.
• Click on ID Governance > Entitlement management.

The rest of the process is divided into the following sections.

• Catalogs
• Access Packages
  • Basics
  • Resource roles
  • Requests
  • Requestor information
  • Lifecycle
  • Review and Create
• User Access Request

Catalogs

Before creating an Access Package, we need to create a Catalog. A Catalog is a collection of resources that Access Packages can use. Catalogs help organize resources and can enable delegated management without excessive permissions.

• Click on Catalogs.

• Click on New catalog.

• Enter a name and description for the catalog.

In my example, I will enter the name as Project Neo and the description as Access to project Neo.

• For Enabled for users to request, decide if users can request access to the Access Packages within the Catalog.

In my example, I will select Yes.

• For Enabled for external users to request, decide if external users can request access to Access Packages within the Catalog.

In my example, I will select No.

• Click Create.

• Click on the Catalog you just created.

In my example, I will click on the Project Neo catalog I just created.

• In the Manage section, click on Resources.

…

Read More Read More