Microsoft Entra ID Governance vs Veza
ILM Reference editors · Editorial assessment · Published 2026-09-28
Veza scores higher overall on our weights: 69/100 against 64/100 for Microsoft Entra ID Governance. Microsoft Entra ID Governance wins two of the seven criteria (JML automation and pricing transparency) and Veza wins four (disconnected-app coverage, orphan and local account discovery, certification campaign depth and works alongside existing IdP and IGA); they tie on audit evidence. On disconnected-app coverage, the heaviest-weighted criterion, Veza leads 65 to 50.
- Lifecycle coverage score
- 64 / 100
- Rank of 8
- 5
- Category
- Identity governance and administration (IGA)
- Designation
- Best value for Microsoft-centric estates
- Lifecycle coverage score
- 69 / 100
- Rank of 8
- 3
- Category
- Access graph and governance
- Designation
- Best for entitlement-level visibility
Scores are an editorial assessment of public vendor material. See Editorial method.
How do Microsoft Entra ID Governance and Veza score on each criterion?
| Criterion (weight) | Microsoft Entra ID Governance | Veza | Winner |
|---|---|---|---|
| Disconnected-app coverage (22) | 50 | 65 | Veza |
| Orphan and local account discovery (18) | 55 | 80 | Veza |
| JML automation (15) | 80 | 72 | Microsoft Entra ID Governance |
| Certification campaign depth (12) | 72 | 78 | Veza |
| Audit evidence (13) | 70 | 70 | Tie |
| Works alongside existing IdP and IGA (12) | 50 | 75 | Veza |
| Pricing transparency (8) | 95 | 20 | Microsoft Entra ID Governance |
| Lifecycle coverage score | 64 | 69 | Veza |
Read the reasons for each score
- Disconnected-app coverage
- Microsoft Entra ID Governance: Documents a manual path for apps without provisioning: export users to CSV, match them to Entra users, review, then remove or ticket; ECMA connector host covers some on-prem apps.
- Veza: Reveals accounts that exist outside identity platforms; custom systems connect through the Open Authorization API.
- Orphan and local account discovery
- Microsoft Entra ID Governance: Account discovery shows app users that do not match any Entra ID user.
- Veza: Detects dormant accounts and reveals local, machine and service accounts.
- JML automation
- Microsoft Entra ID Governance: Lifecycle workflows before start, during status changes and at departure.
- Veza: Birthright access, role-change and offboarding automation, including local accounts, with Dry Run and Safety Limits.
- Certification campaign depth
- Microsoft Entra ID Governance: Recurring access reviews with AI-powered suggestions; denied users lose the app role assignment.
- Veza: Access certification campaigns prioritized by risk, with effective permissions in plain terms.
- Audit evidence
- Microsoft Entra ID Governance: Review decisions and assignments are recorded in Entra; no framework-mapped evidence pack described.
- Veza: Audit logging for lifecycle actions; no framework-specific evidence export described on the pages reviewed.
- Works alongside existing IdP and IGA
- Microsoft Entra ID Governance: Requires Entra ID P1 or P2; strongest when Entra is the identity provider.
- Veza: Integrates with Okta and HR sources and adds visibility beside existing IdP tooling.
- Pricing transparency
- Microsoft Entra ID Governance: $7.00 per user per month, paid yearly, published.
- Veza: No public pricing.
What does each tool do?
Microsoft's governance add-on for lifecycle workflows, access reviews and entitlement management, priced per user.
Category Identity governance and administration (IGA)
Builds an Access Graph of effective permissions across 325+ integrations and runs reviews and lifecycle actions on top of it.
Category Access graph and governance
How do Microsoft Entra ID Governance and Veza compare on pricing and deployment?
| Fact | Microsoft Entra ID Governance | Veza |
|---|---|---|
| Pricing | $7.00 user/month, paid yearly (requires Entra ID P1 at $7.00 or P2 at $10.00). Entra Suite $12.00 user/month. | Not published. Contact sales. |
| Deployment | Microsoft cloud service. | SaaS (agentless integrations as described by Veza). |
How do they handle disconnected applications?
| Tool | Discovery of the app | Account data collection | Leaver action on the app | Method described | Source |
|---|---|---|---|---|---|
| Veza | Not documented | Documented accounts outside identity platforms, custom systems via OAA | Documented offboarding including local accounts | Access Graph integrations and OAA | Source: veza.com lifecycle and access reviews pages · Reviewed Sep 2026 |
| Microsoft Entra ID Governance | Not documented | Manual process export users to CSV and match to Entra users | Manual process access review, then removal or a ServiceNow ticket | Documented manual procedure | Source: learn.microsoft.com not-provisioned users article · Reviewed Sep 2026 |
Source: veza.com lifecycle and access reviews pages · Reviewed Sep 2026
Source: learn.microsoft.com not-provisioned users article · Reviewed Sep 2026
Which should you choose?
Choose Microsoft Entra ID Governance if you need a published price to model the budget before a sales call, or if HR-driven joiner, mover and leaver automation is the priority.
Microsoft's governance add-on for lifecycle workflows, access reviews and entitlement management, priced per user.
Choose Veza if finding orphan, dormant and local accounts is the priority, or if you need coverage for applications with no connector, no SCIM endpoint and no SSO integration.
Builds an Access Graph of effective permissions across 325+ integrations and runs reviews and lifecycle actions on top of it.
Weights change the answer. Try your own in the calculator.
FAQ
Which is better for identity lifecycle management, Microsoft Entra ID Governance or Veza?
On our rubric Veza scores 69/100 and Microsoft Entra ID Governance 64/100. Veza is ahead mainly on orphan and local account discovery and disconnected-app coverage. Buyers who weight pricing transparency more heavily may prefer Microsoft Entra ID Governance; the calculator shows how the order changes.
Which handles disconnected applications better, Microsoft Entra ID Governance or Veza?
Veza scores 65 to 50 on disconnected-app coverage. Microsoft Entra ID Governance: Documents a manual path for apps without provisioning: export users to CSV, match them to Entra users, review, then remove or ticket; ECMA connector host covers some on-prem apps. Veza: Reveals accounts that exist outside identity platforms; custom systems connect through the Open Authorization API.
Do Microsoft Entra ID Governance and Veza publish pricing?
Microsoft Entra ID Governance: $7.00 user/month, paid yearly (requires Entra ID P1 at $7.00 or P2 at $10.00). Entra Suite $12.00 user/month. Veza: Not published. Contact sales.
Keep reading
Sources
- learn.microsoft.com identity governance overview
- microsoft.com Entra pricing
- learn.microsoft.com apps not provisioned
- learn.microsoft.com existing app users
- veza.com lifecycle management
- veza.com access reviews
- veza.com
Reviewed Sep 2026