Microsoft Entra ID Governance Certification

Search for "Entra ID Governance certification" and you will find courses, but not a certificate. Microsoft does not offer one. What exists is a product, Microsoft Entra ID Governance, and an exam domain that tests it: "Plan and implement identity governance", worth roughly a fifth to a quarter of the SC-300 Identity and Access Administrator exam. If you want a credential that says you can run identity governance in Entra, SC-300 is it, and this guide covers the governance part. For the rest of that exam, see the companion SC-300 preparation guide.

Weights and domain names change when Microsoft updates the skills outline, so check the current one on Microsoft Learn before you book.

01What Identity Governance Means in Entra

Authentication answers "is this the right person". Governance answers "should this person still have this access, who decided, and can we prove it". In Microsoft Entra that question is handled by four features that are usually discussed together:

The licensing is the part most people get wrong, so here it is up front. Access reviews, basic entitlement management and PIM come with Microsoft Entra ID P2. Lifecycle workflows, machine learning recommendations in access reviews, custom extensions in entitlement management, and Verified ID in access packages need the Microsoft Entra ID Governance license, which is sold as an add-on to P1 or P2 (there is also a "step-up" SKU for tenants that already have P2). Every user who benefits from a governed feature needs the license, not only the admins. The exam does ask which feature needs which license.

02Entitlement Management

Entitlement management is the request-and-approval system. The objects to know:

• A catalog is a container, usually one per business unit or application team, that holds resources and access packages and has its own owners.
• A resource is a group, an application, or a SharePoint site added to a catalog.
• An access package bundles resources with one or more policies. A policy says who may request (internal users, specific connected organizations, or anyone), who approves (single or multi-stage), how long the assignment lasts, and whether it is reviewed.
• A connected organization is an external tenant or domain whose users may request packages. Entitlement management creates the B2B guest account for them on first approval and, because the assignment expires, removes the guest when nothing else keeps them.
• Auto-assignment policies grant a package to everyone matching a user attribute filter, which is how you implement "every employee in department X gets this access" without a request.

The design decision that matters is granularity. One access package per application is easy to understand but produces hundreds of packages. One package per job function is fewer packages but harder to review. Most teams land on function-level packages for common access and application-level packages for anything sensitive.

graph TD
  U["User or guest"] -->|"requests"| AP["Access package"]
  AP -->|"policy: approvers, duration"| A["Approver["s"]"]
  A -->|"approve"| AS["Assignment with expiry"]
  AS --> G["Group membership"]
  AS --> APP["App role assignment"]
  AS --> SP["SharePoint site"]
  AS -->|"on expiry or review denial"| R["Access removed"]

03Access Reviews

An access review asks a reviewer to confirm or deny each person's access to a group, an application, an access package, or a PIM role. Settings to understand for the exam and for real life:

• Reviewer: the resource owner, the user's manager, selected people, or the users themselves (self-review is for guests, and a weak control for anything else).
• Recurrence and duration: quarterly for ordinary groups, monthly for privileged ones.
• Auto-apply results: if on, denied users are removed when the review ends. If off, someone must apply the results by hand, and in practice nobody does.
• If reviewers do not respond: no change, remove access, or take recommendations. "Remove access" is the only setting that makes a review a control rather than a ritual, but it needs reviewers who actually respond.
• Recommendations: the review can suggest a decision based on sign-in activity (30 days of inactivity, or no affiliation with the reviewer's reports). The sign-in based recommendation needs the Governance license.
• Multi-stage reviews let a manager review first and an owner second, which is how you satisfy auditors who want two sets of eyes on privileged access.

Inactive guest cleanup is the review most tenants should run first: review all guests across the tenant, recommend removal after 30 days of inactivity, and auto-apply.

04Privileged Identity Management

PIM makes administrative roles just-in-time. A user is eligible for a role; to use it they activate it for a bounded time, optionally with MFA, a justification, a ticket number, or an approval. Permanent active assignments remain possible and are what you are trying to eliminate.

Scope matters in three directions: Entra roles (Global Administrator and friends), Azure resource roles (Owner on a subscription), and PIM for Groups, which puts the same activation model on membership of any group. PIM for Groups is how you make a third-party application's admin group just-in-time when the application only understands group membership.

Role settings to configure per role: maximum activation duration, MFA on activation, approval required, notification recipients, and the maximum eligible assignment duration. The exam likes the distinction between "eligible" and "active" and between "permanent" and "time-bound", and it likes scenario questions where a Conditional Access authentication context is required on activation.

05Lifecycle Workflows

Lifecycle workflows automate joiner, mover and leaver tasks from attributes in Entra. The trigger is usually employeeHireDate or employeeLeaveDateTime, synced from the HR system, with an offset ("seven days before hire date"). Built-in tasks include generating a temporary access pass, sending a welcome email, adding to groups and Teams, removing licenses, deleting the user, and, since 2024, running a custom task extension, which is an Azure Logic App that can call anything (a ticketing system, a non-Microsoft SaaS, a mainframe gateway).

A working leaver workflow looks like this in order: on the leave date, disable the account, remove all group memberships and licenses, remove the authentication methods; thirty days later, delete the user. Movers are the hard case because "department changed" is a scheduled attribute-based trigger and the right response depends on where the person moved to; many teams handle movers with access reviews triggered by the change rather than with an automated workflow.

06Where the Exam and the Job Differ

The exam tests whether you can pick the right feature and setting for a scenario. The job tests whether you can get owners to review, managers to approve on time, and HR to keep hire and leave dates accurate. Three gaps to be ready for:

1. Connected systems. Entra governs what Entra knows about. Applications that are not integrated for provisioning (SCIM, or the on-premises provisioning agent for SQL and LDAP targets) will not have their access removed by a review or a workflow. Governance is only as good as provisioning coverage.
2. Source of truth. Lifecycle workflows depend on HR-driven attributes. If employeeLeaveDateTime is never populated, leavers are never processed. Fix the HR integration before you build workflows on it.
3. Reviewer fatigue. A tenant that launches reviews on every group at once trains reviewers to approve everything. Start with privileged roles and guests, prove the results, then expand.

07Six-Week Study Plan

This assumes a tenant you can break. An Entra ID Governance trial or a dedicated test tenant works; do not experiment in production.

Keep the labs in a short document as you go. On exam day, the scenario questions are easier when you can picture the blade you configured rather than the paragraph you read.

08Common Mistakes

• Reviewing with auto-apply off. The review completes, nothing changes, and the audit finding stays open.
• Access packages without expiry. An assignment that never expires is a group membership with extra steps.
• Permanent active admin assignments "for break-glass". Keep two emergency accounts excluded from Conditional Access and monitored, and make everything else eligible.
• Workflows before HR data. See above; the workflow runs on the attribute, and an empty attribute runs nothing.
• Assuming the Governance license covers guests automatically. Guests governed by access packages and reviews are counted, and Microsoft's licensing guidance on guest billing has changed more than once. Read the current page before you present the cost.

09Quick Reference

10Key Takeaways

• The credential is SC-300; governance is one of its four domains, and the most hands-on one.
• Four features do the work: entitlement management, access reviews, PIM and lifecycle workflows. Know what triggers each and what each needs in licensing.
• Reviews only count as a control when results are applied automatically.
• Governance reaches only the systems that provisioning reaches and only the attributes HR keeps accurate.
• Build every feature once in a test tenant before the exam; the scenario questions reward people who have seen the blades.