Microsoft Entra ID Governance

View reports and logs in entitlement management

18 September 2026New feature+78 / −3 lines

In brief

The documentation adds access package drift reporting for groups and enterprise applications, including detection, remediation, export, roles, licensing, refresh timing, and limitations. The reports are in preview.

What Entra admins need to know

Administrators can identify unauthorized or missing access assignments. Microsoft Entra ID Governance or Microsoft Entra Suite licensing and an appropriate directory role are required to view or download reports.

This editorial summary was generated by AI from the documentation changes. Verify important details in the full Microsoft Learn article.

Documentation change

View full page diff

View on Microsoft Learn

The comparison below shows only the changed extract. Use the full-page view for complete context.

View reports and logs in entitlement management

If you select to omit entitlement activity, then only changes to application roles that weren't made by entitlement management are shown. For example, you would see a row if a Global Administrator had directly assigned a user to an application role.

View access package drift

Access package drift reports show where access to governed groups and enterprise applications no longer matches entitlement management policies. You can use this report to find users who have direct resource access without an access package assignment, and users who have an active access package assignment without the expected group membership or application assignment.

Access package drift reports are in preview.

Before you view access package drift reports, make sure your tenant has a Microsoft Entra ID Governance or Microsoft Entra Suite add-on license.

To view access package drift reports in the Microsoft Entra admin center, use one of the following roles:

Global Administrator.
Identity Governance Administrator.
Directory Reader.
Reports Reader.
Catalog Owner.
Catalog Reader.

To download access package drift reports, use one of the following roles:

Global Administrator.
Identity Governance Administrator.
Directory Reader.
Reports Reader.

Access package drift reports include:

Microsoft Entra groups that have members without corresponding access package assignments.
Enterprise applications that have application role assignments without corresponding access package assignments.
Active access package assignments where the expected group membership or application assignment is missing.

To review access package drift:

Sign in to the Microsoft Entra admin center.
Browse to ID Governance > Access Guardian > Reports > Access Drift.
The Access Drift page shows an Access drift data as of timestamp and lists only resources where drift is detected. If the same resource is included in more than one catalog, the resource appears once for each catalog.
Review the Detected drift summary and the resource table.
The summary shows the number of resources with detected drift. The resource table is separated into Groups and Applications tabs. You can search by resource or catalog name, filter by catalog, and review the Resource, Total drift, Unauthorized access, Missing access, and Catalog columns.
To view the underlying resource, select View group or View application.
Search for a specific resource, or select the resource name from the table to open the drift details.
On the drift details page, review the users with drift for the selected resource.
Drift details are grouped by category:
- Unauthorized access: Access granted outside of governance policies.
- Missing assignments: Access granted through an access package, but missing from the resource.
- Total drift: All access discrepancies for the selected resource.
The details table shows the user, access package, expected access package role, current Microsoft Entra role, and drift category. You can search by display name or role.
Remediate the drift.
To remediate unauthorized access, assign users to an access package. The access package picker is scoped to the catalog for the selected resource and shows whether an access package includes the resource. To remediate missing access, reprocess access package assignments for selected users.
After you submit a remediation action, the change is applied to the resource directly and might take a few minutes. Because drift reports are refreshed on a schedule, remediated rows will not change until the next report update.
To export access drift details, select Download.

The downloadable report includes drift across all catalogs in the tenant. The download in the Microsoft Entra admin center can't be scoped to a single catalog.

The report currently refreshes about once a day, so data can be up to 24 hours old. Because access package drift reports are in preview, this refresh schedule might change before general availability. Refer to the Access drift data as of timestamp on the page to confirm how current the results are.

Access package drift reports have the following limitations:

Drift between entitlement management and third-party applications, Azure roles, or SharePoint sites isn't included.
Nested group drift isn't included. The report only shows drift between access package assignments and users directly assigned to the group.

View orphan or local accounts in your applications

Administrators of your connected applications (Salesforce, SAP Cloud Identity Services, etc.) can manually create accounts in your applications, circumventing the governance controls in place. Using the account discovery functionality, you can generate a report of all the users in your application, identify which users have matching Microsoft Entra accounts, and which users are local to your application with one click. The report classifies accounts as local accounts, unassigned users, or assigned users, which helps you identify unmanaged access and access drift. It enables you to simplify onboarding to Microsoft Entra, while also periodically monitoring for unauthorized access. For detailed steps, see Discover identities in target applications with Account Discovery.

Next steps

@@ -4,10 +4,11 @@ description: Learn how to view the identity assignments report and audit logs in editor: jocastel-MSFT ms.subservice: entitlement-management ms.topic: how-to-ms.date: 03/10/2025+ms.date: 09/03/2026 ms.reviewer: jocastel-ms.custom: sfi-ga-nochange, sfi-image-nochange-#Customer Intent: As an IT admin, I want to view reports and audit logs in entitlement management so that I can monitor identity assignments and access changes.+ai-usage: ai-assisted+ms.custom: sfi-ga-nochange, sfi-image-nochange, msecd-doc-authoring-1026+#customer intent: As an IT admin, I want to view reports and audit logs in entitlement management so that I can monitor identity assignments and access changes. ---  # View reports and logs in entitlement management@@ -165,12 +166,86 @@ The workbook *Application role assignment activity* shows if there have been cha  1. If you select to omit entitlement activity, then only changes to application roles that weren't made by entitlement management are shown. For example, you would see a row if a Global Administrator had directly assigned a user to an application role. +## View access package drift++Access package drift reports show where access to governed groups and enterprise applications no longer matches entitlement management policies. You can use this report to find users who have direct resource access without an access package assignment, and users who have an active access package assignment without the expected group membership or application assignment.++Access package drift reports are in preview.++Before you view access package drift reports, make sure your tenant has a Microsoft Entra ID Governance or Microsoft Entra Suite add-on license.++To view access package drift reports in the Microsoft Entra admin center, use one of the following roles:++- Global Administrator.+- Identity Governance Administrator.+- Directory Reader.+- Reports Reader.+- Catalog Owner.+- Catalog Reader.++To download access package drift reports, use one of the following roles:++- Global Administrator.+- Identity Governance Administrator.+- Directory Reader.+- Reports Reader.++Access package drift reports include:++- Microsoft Entra groups that have members without corresponding access package assignments.+- Enterprise applications that have application role assignments without corresponding access package assignments.+- Active access package assignments where the expected group membership or application assignment is missing.++To review access package drift:++1. Sign in to the [Microsoft Entra admin center](https://entra.microsoft.com).++1. Browse to **ID Governance** > **Access Guardian** > **Reports** > **Access Drift**.++    The Access Drift page shows an **Access drift data as of** timestamp and lists only resources where drift is detected. If the same resource is included in more than one catalog, the resource appears once for each catalog.++1. Review the **Detected drift** summary and the resource table.++    The summary shows the number of resources with detected drift. The resource table is separated into **Groups** and **Applications** tabs. You can search by resource or catalog name, filter by catalog, and review the **Resource**, **Total drift**, **Unauthorized access**, **Missing access**, and **Catalog** columns.++    To view the underlying resource, select **View group** or **View application**.++1. Search for a specific resource, or select the resource name from the table to open the drift details.++1. On the drift details page, review the users with drift for the selected resource.++    Drift details are grouped by category:++    - **Unauthorized access**: Access granted outside of governance policies.+    - **Missing assignments**: Access granted through an access package, but missing from the resource.+    - **Total drift**: All access discrepancies for the selected resource.++    The details table shows the user, access package, expected access package role, current Microsoft Entra role, and drift category. You can search by display name or role.++1. Remediate the drift.++    To remediate unauthorized access, [assign users to an access package](entitlement-management-access-package-assignments.md#directly-assign-an-identity). The access package picker is scoped to the catalog for the selected resource and shows whether an access package includes the resource. To remediate missing access, [reprocess access package assignments](entitlement-management-reprocess-access-package-assignments.md) for selected users.++    After you submit a remediation action, the change is applied to the resource directly and might take a few minutes. Because drift reports are refreshed on a schedule, remediated rows will not change until the next report update.++1. To export access drift details, select **Download**.++The downloadable report includes drift across all catalogs in the tenant. The download in the Microsoft Entra admin center can't be scoped to a single catalog.++The report currently refreshes about once a day, so data can be up to 24 hours old. Because access package drift reports are in preview, this refresh schedule might change before general availability. Refer to the Access drift data as of timestamp on the page to confirm how current the results are. ++Access package drift reports have the following limitations:++- Drift between entitlement management and third-party applications, Azure roles, or SharePoint sites isn't included.+- Nested group drift isn't included. The report only shows drift between access package assignments and users directly assigned to the group. + ## View orphan or local accounts in your applications  Administrators of your connected applications (Salesforce, SAP Cloud Identity Services, etc.) can manually create accounts in your applications, circumventing the governance controls in place. Using the account discovery functionality, you can generate a report of all the users in your application, identify which users have matching Microsoft Entra accounts, and which users are local to your application with one click. The report classifies accounts as local accounts, unassigned users, or assigned users, which helps you identify unmanaged access and access drift. It enables you to simplify onboarding to Microsoft Entra, while also periodically monitoring for unauthorized access. For detailed steps, see [Discover identities in target applications with Account Discovery](~/identity/app-provisioning/how-to-account-discovery.md).  ## Next steps +- [Reconciliation overview](reconciliation-overview.md) - [Archive reports and Logs](entitlement-management-logs-and-reporting.md) - [Troubleshoot entitlement management](entitlement-management-troubleshoot.md) - [Create custom alerts for entitlement management](governance-custom-alerts.md)