Microsoft Entra ID Governance review: lifecycle workflows and access reviews

ILM Reference editors · Editorial assessment · Last reviewed September 2026

SUMMARYREV. 2026-09

Microsoft Entra ID Governance scores 64/100, fifth of eight, and is the only tool here with a fully published price: $7.00 per user per month, paid yearly, on top of Entra ID P1 or P2. Lifecycle workflows and access reviews are solid for applications connected to Entra. For applications that do not support provisioning, Microsoft's own documentation describes a manual CSV export, match and review process.

RECORD · MICROSOFT ENTRAREV. 2026-09

Vendor: Microsoft
Category: Identity governance and administration (IGA)
Designation: Best value for Microsoft-centric estates
Lifecycle coverage score: 64 / 100
Rank: 5 of 8
Pricing: $7.00 user/month, paid yearly (requires Entra ID P1 at $7.00 or P2 at $10.00). Entra Suite $12.00 user/month.
Deployment: Microsoft cloud service.
Last reviewed: September 2026

Scores are an editorial assessment of public vendor material. See Editorial method.

How does Microsoft Entra score on each criterion?

Disconnected-app coverage 22%

50 / 100

Documents a manual path for apps without provisioning: export users to CSV, match them to Entra users, review, then remove or ticket; ECMA connector host covers some on-prem apps.

Orphan and local account discovery 18%

55 / 100

Account discovery shows app users that do not match any Entra ID user.

JML automation 15%

80 / 100

Lifecycle workflows before start, during status changes and at departure.

Certification campaign depth 12%

72 / 100

Recurring access reviews with AI-powered suggestions; denied users lose the app role assignment.

Audit evidence 13%

70 / 100

Review decisions and assignments are recorded in Entra; no framework-mapped evidence pack described.

Works alongside existing IdP and IGA 12%

50 / 100

Requires Entra ID P1 or P2; strongest when Entra is the identity provider.

Pricing transparency 8%Leader

95 / 100

$7.00 per user per month, paid yearly, published.

What does Entra ID Governance do for identity lifecycle management?

Microsoft lists lifecycle workflows that run before a new employee starts, as employees change status, and as they leave; recurring access reviews with AI-powered suggestions; and entitlement management with approval workflows, separation-of-duties checks and time-bound access. Provisioning reaches applications through SCIM, LDAP, SQL, SOAP or REST, and the ECMA connector host for on-premises applications.

How does Entra handle disconnected applications?

Microsoft documents the process for 'an application that does not support provisioning': export the application's users to a CSV file (from LDAP, SQL or the application's admin console), match them to Entra ID users with PowerShell, create application role assignments, then run an access review. Denied users lose their role assignment in Entra, and removal inside the application is manual, optionally through ServiceNow tickets created by entitlement management. It works, and it is documented, but each cycle is an export.

For applications that do support provisioning, Entra's account discovery report shows which users in the application do not match an Entra ID user. Those unmatched accounts are the starting list for orphan-account review.

What does it cost?

Microsoft's pricing page lists Entra ID Governance at $7.00 per user per month, paid yearly, and states it requires Entra ID P1 ($7.00) or P2 ($10.00). Microsoft Entra Suite is $12.00 per user per month.

What are the watch-outs?

Strongest when Entra ID is the identity provider.
Disconnected apps rely on repeated CSV exports and manual removal.
No framework-mapped evidence pack described; evidence is review history and assignments.

Who should shortlist Microsoft Entra?

Microsoft-centric organizations that want lifecycle workflows and access reviews at a published price, with a small number of disconnected apps they can handle by documented manual process.

FAQ

How much is Microsoft Entra ID Governance?

$7.00 per user per month, paid yearly, per Microsoft's pricing page, with Entra ID P1 or P2 as a prerequisite.

Can Entra review access to an app that is not connected?

Yes, if you import its users. Microsoft documents exporting users to CSV, matching them to Entra users and creating role assignments before running the review.