Plan and Automate Identity Governance (20–25%)
Governance answers three questions: who should have access, who still needs it, and who can be an administrator right now. It also covers the logs you use to prove it. Microsoft weights the domain at 20–25%. Most features need Microsoft Entra ID P2 or Microsoft Entra ID Governance.
The examples follow Northwind's project with partner Fabrikam, and its admin team.
Entitlement Management
- Catalogs hold resources (groups and Teams, applications, SharePoint sites) and can be delegated to catalog owners.
- Access packages bundle resource roles from one catalog. Each package has one or more policies: who can request (internal users, specific connected organizations, any external user), approval stages, requestor questions, expiration, and built-in access reviews.
- Connected organizations register partner tenants or domains; their users can request without an invitation and become B2B guests when approved.
- External user lifecycle (settings): when an external user loses their last assignment, block sign-in and remove them after a set number of days.
- Terms of use (P1) are created in ID Governance and enforced as a Conditional Access grant control, with optional expiry or re-acceptance.
Example: Fabrikam engineers join Project Atlas for 90 days.
Fabrikam = connected organization
Access package "Atlas" = Team "Atlas" + SharePoint "Atlas" + app role Jira-Contributor
Policy: Fabrikam users may request → sponsor approves → expires after 90 days
Last assignment ends → sign-in blocked → guest removed after 30 daysTakeaway: request plus approval plus expiry is an access package; partner users without invites need a connected organization.
Access Reviews
Reviews re-certify existing access on a schedule.
| Setting | Options |
|---|---|
| Scope | Group members (or guests only), app assignments, access package assignments, Entra and Azure roles (through PIM) |
| Reviewers | Group owners, managers, users themselves, selected reviewers, multi-stage |
| Recurrence and duration | One-time, weekly, monthly, quarterly, annually |
| Auto apply results | Remove denied users automatically at the end |
| If reviewers don't respond | No change, Remove access, Approve access, Take recommendations |
| Helpers | Recommendations (based on sign-in activity), justification required |
Example: quarterly review of guests in the Sales group.
Unlock with a paid plan
1 more section (about 441 words) continue below. Every paid plan unlocks all SC-300 study guides, the full question bank and mock exams, from $4.97/month.