Identity governance is a set of capabilities for managing identities, approvals, access assignments, and the audit trail around them. It spans the administration and auditing pillars of identity: simplify access management, document who did what and when, and keep permissions aligned as people join, change roles, or leave. section 2.1 section 2.6
Use the four pillars to place identity governance alongside authentication and authorization: administration manages access processes, while auditing records activity. section 2.1
The operational goal is to balance security with productivity. Governance helps limit privileged access through Privileged Identity Management (PIM), then reassesses access as job responsibilities and required resource permissions change. This supports least privilege without assuming that an initial assignment remains appropriate forever. section 2.14 section 2.6
Access reviews provide an ongoing process for deciding whether access remains needed:
- Review Azure resource roles, Azure AD roles, Azure AD group memberships, integrated applications, or access packages. section 2.6.3
- Choose a reviewer, commonly the Azure workload owner, to keep or remove access. section 2.6.3
- Set a start date, recurrence, review duration, ending condition, user scope, role membership, and reviewer options. section 2.6.3
- Configure automatic removal for users denied at the end of a review when appropriate. section 2.6.3
Recurring review of privileged Azure resource roles
In the Azure portal, open Identity Governance, then Privileged Identity Management and Azure Resources. Select a subscription, create an Access Review, choose the privileged roles and identities to review, assign reviewers, schedule the frequency, and decide how denied access is handled when the review ends. section 2.6.3
