Managed Entra ID Identity Hygiene and Access Reviews

A recurring monthly service in which IT Partner operates the identity hygiene of your existing Microsoft Entra ID tenant: stale user and guest cleanup, app registration secret and certificate expiry watch, privileged-role and PIM assignment review, Conditional Access drift checks against a documented baseline, enterprise-app consent review, quarterly access-review campaigns run end to end, and a monthly report written for auditors. It costs $3 per user per month with no long-term commitment.

Organizations of roughly 50 to 1,000 users that have already invested in Entra ID governance or Conditional Access — with us or with anyone — and have no identity engineer to keep it clean afterward. If your auditor's last evidence request took three weeks to answer, or your insurer's renewal asked about privileged-access reviews and the honest answer was 'we mean to', this service is the missing role.

It depends on the scope you want. Conditional Access needs Microsoft Entra ID P1, which Microsoft 365 Business Premium, E3, and E5 include. PIM and access reviews need Microsoft Entra ID P2 — included in Microsoft 365 E5 and EMS E5, or licensed standalone — for the users with eligible assignments, the approvers, and the reviewers. The Microsoft Entra ID Governance add-on or the Microsoft Entra Suite unlocks inactive-user recommendations, affiliation recommendations, multi-resource reviews, and lifecycle workflows. Microsoft also meters guest governance actions per governed guest per month through an Azure subscription. We verify all of this at onboarding, tell you exactly what your licensing supports, and quote any Microsoft costs before you buy anything.

Yes, with an honest boundary. Business Premium includes Entra ID P1, so the Conditional Access drift check, stale-account cleanup from sign-in activity, application credential watch, role review, and consent review all run in full. What P1 cannot do is formal access-review campaigns or PIM — those need P2. Many clients start the hygiene cycle on P1, and add P2 for the privileged users and reviewers when they want the quarterly review evidence; we will tell you at onboarding which report sections your licensing can and cannot fill.

Direction and rhythm. Administrator on Demand is reactive and hourly: you raise a task, we do it. This service is proactive and fixed: a scheduled monthly cycle that finds the problems nobody raised, on a per-user fee, producing evidence as it goes. Most clients keep both — the hourly service for the unexpected, this one for the discipline — and the monthly cycle tends to shrink the number of unexpected tasks.

MDR and Sentinel monitoring watch for active attacks and respond, around the clock. This service shrinks what those attacks can use: fewer dormant accounts to hijack, fewer forgotten secrets to steal, fewer standing admins to phish, fewer Conditional Access gaps to slip through. One is detection and response; the other is hygiene. They are complementary and deliberately non-overlapping — if our monthly cycle turns up something that looks like compromise rather than entropy, it goes to your incident path or MDR provider immediately, not into next month's report.

For each scope agreed at onboarding — group and team memberships, application assignments, privileged roles, guests — we configure the campaign in Microsoft Entra access reviews with the no-response outcome you chose, brief the reviewers on what they are deciding and why, chase completion through the review window, apply the results (removals happen), and archive the decisions and completion records as evidence. Where your licensing includes Entra ID Governance, inactive-user and affiliation recommendations are turned on so reviewers get a suggested answer instead of a blank list.

Each month we identify member users and guests past the inactivity thresholds recorded in your service order, confirm with their owners or your contact, and disable or remove them with your approval — recording each decision, including the decision to keep an account. Disabling comes before deleting, so a wrongly flagged account is a one-minute reversal. Microsoft's guest governance metering applies to guests governed through access reviews and is a Microsoft cost we name at onboarding.

Every app registration and service principal in your tenant can hold client secrets and certificates, and each one has an expiry — or does not, which is worse. Expired credentials break integrations at inconvenient hours; unexpired, unused ones are standing credentials waiting to be found. We track them all against expiry, flag renewals to their owners on the agreed lead time, and recommend removing credentials and applications nobody uses, using Microsoft Entra's recommendations where your licensing surfaces them and our own inventory where it does not.

No. We find, recommend, and document; you decide; we execute and record. Access decisions are business decisions, and an auditor wants to see that the business made them — which is why every action in the monthly report carries an approver, not just a timestamp.

Accounts disabled or removed with their approvals, credentials renewed or retired, the privileged-access state against the approved minimum, Conditional Access drift found and how it was resolved, consents reviewed, quarterly review status and evidence references, and open recommendations with owners. It is written so an auditor's evidence request, a cyber-insurance questionnaire, and a leadership update can all be answered from the same document without rework.

Least-privilege GDAP that you approve — Microsoft's granular, time-bound partner access model. Our default request is Microsoft's standard starter relationship; anything more is requested per task and expires. We never ask for standing Global Administrator, and our default access policy is published so you can compare it against what we actually request.

Usually, yes — the onboarding baseline exists to find out. We document what is there, flag what is broken or risky in writing, and absorb ordinary cleanup into the first monthly cycles. If the baseline reveals structural problems — no Conditional Access at all, hundreds of stale guests, a decade of app registrations — we say so plainly and quote the cleanup or the implementation as a project, so the monthly fee stays honest about what it covers.

Monthly, at $3 per user in the agreed scope, reconciled monthly as headcount changes, with no long-term contract: stop any month, and all we ask is payment of previously approved invoices. Everything the service produced stays yours — the baseline, the reports, the archived review evidence, and every cleanup already done. No lock-in in either direction is a published IT Partner term, not a promotional line.

The first monthly cycle is the onboarding: GDAP access, the baseline document, the service order with thresholds, review scopes, and allowance, and the first hygiene pass. From the second cycle the service is in steady state, and the first quarterly review campaign runs on the cadence agreed at onboarding. If we performed your governance or Conditional Access implementation, onboarding is mostly a handover to ourselves and the baseline already exists in draft.