Microsoft Entra ID Governance
FundamentalsThe principle of least privilege with Microsoft Entra ID Governance
In brief
The documentation now frames least privilege around identities, including human users, applications, and agents. It also adds delegation guidance describing entitlement management for access requests, assignments, reviews, and expiration.
What Entra admins need to know
Administrators should include applications and agents when applying least-privilege governance and access reviews.
This editorial summary was generated by AI from the documentation changes. Verify important details in the full Microsoft Learn article.
Documentation change
View on Microsoft LearnThe comparison below shows only the changed extract. Use the full-page view for complete context.
The principle of least privilege with Microsoft Entra ID Governance
One concept that needs to be addressed before under taking an identity governance strategy is the principle of least privilege (POLP). Least privilege is a principle in identity governance that involves assigning usersidentities, including for human users, applications and groupsagents, only the minimum level of access and permissions necessary to perform their duties. The idea is to restrict access rights so that a userperson, agent or groupapplication can complete their work, but also minimizing unnecessary privileges that could potentially be exploited by attackers or lead to security breaches.
In regards to Microsoft Entra ID Governance, applying the principle of least privilege helps enhance security and mitigate risks. This approach ensures that users and groupsidentities are granted access only to the resources, data, and actions that are relevant to their roles and responsibilities, and nothing beyond that.
Key concepts of the principle of least privilege
Access to only required resources:
UsersUsers, applications and agents are given access to information and resources only if they have a genuine need for them to perform their tasks. This prevents unauthorized access to sensitive data and minimizes the potential impact of a security breach.AutomatingFor employees and business guests, automating user provisioning helps reduce unnecessary granting of access rights. Lifecycle workflows is an identity governance feature that enables organizations to manage Microsoft Entra users by automating basic lifecycle processes.Role-Based Access Control (RBAC): Access rights are determined based on the specific roles or job functions of users. Each role is assigned the minimum permissions necessary to fulfill its responsibilities. Microsoft Entra role-based access control manages access to Microsoft Entra
resources.resources, and entitlement management can be used to implement a role approach for your own and third party applications.Just-In-Time Privilege: Access rights are granted only for the duration of time that they're needed and are revoked when they're no longer required. This reduces the window of opportunity for attackers to exploit excessive privileges. Privileged Identity Management (PIM) is a service in Microsoft Entra ID that enables you to manage, control, and monitor access to important resources in your organization and can provide just-in-time access.
Regular Auditing and Review: Periodic reviews of user access and permissions are conducted to ensure that users still require the access they have been granted. This helps to identify and rectify any deviations from the least privilege principle. Access reviews in Microsoft Entra ID, part of Microsoft Entra, enable organizations to efficiently manage group memberships, access to enterprise applications, role assignments, and
role assignments.permissions brought in from applications. User's access can be reviewed regularly to make sure only the right people have continued access.Default Deny: The default stance is to deny access, and access is explicitly granted only for approved purposes. This contrasts with a "default allow" approach, which can result in granting unnecessary privileges.
Delegation:Entitlement management is an identity governance feature that enables organizations to manage identity and access lifecycle at scale, by automating access request workflows, access assignments, reviews, and expiration. This includes assigning approval and review tasks to the relevant decision makers, such as managers, sponsors or resource owners, who can confirm when access is no longer required as the subject's job role or tasks have changed.
By following the principle of least privilege, your organization can reduce the risk of security issues, and ensure that access controls are aligned with business needs.
@@ -7,21 +7,23 @@ ms.date: 04/09/2025 # The principle of least privilege with Microsoft Entra ID Governance -One concept that needs to be addressed before under taking an identity governance strategy is the principle of least privilege (POLP). Least privilege is a principle in identity governance that involves assigning users and groups only the minimum level of access and permissions necessary to perform their duties. The idea is to restrict access rights so that a user or group can complete their work, but also minimizing unnecessary privileges that could potentially be exploited by attackers or lead to security breaches.+One concept that needs to be addressed before under taking an identity governance strategy is the principle of least privilege (POLP). Least privilege is a principle in identity governance that involves assigning identities, including for human users, applications and agents, only the minimum level of access and permissions necessary to perform their duties. The idea is to restrict access rights so that a person, agent or application can complete their work, but also minimizing unnecessary privileges that could potentially be exploited by attackers or lead to security breaches. -In regards to Microsoft Entra ID Governance, applying the principle of least privilege helps enhance security and mitigate risks. This approach ensures that users and groups are granted access only to the resources, data, and actions that are relevant to their roles and responsibilities, and nothing beyond that.+In regards to Microsoft Entra ID Governance, applying the principle of least privilege helps enhance security and mitigate risks. This approach ensures that identities are granted access only to the resources, data, and actions that are relevant to their roles and responsibilities, and nothing beyond that. ## Key concepts of the principle of least privilege -- **Access to only required resources:** Users are given access to information and resources only if they have a genuine need for them to perform their tasks. This prevents unauthorized access to sensitive data and minimizes the potential impact of a security breach. Automating user provisioning helps reduce unnecessary granting of access rights. [Lifecycle workflows](../what-are-lifecycle-workflows.md) is an identity governance feature that enables organizations to manage Microsoft Entra users by automating basic lifecycle processes.+- **Access to only required resources:** Users, applications and agents are given access to information and resources only if they have a genuine need for them to perform their tasks. This prevents unauthorized access to sensitive data and minimizes the potential impact of a security breach. For employees and business guests, automating user provisioning helps reduce unnecessary granting of access rights. [Lifecycle workflows](../what-are-lifecycle-workflows.md) is an identity governance feature that enables organizations to manage Microsoft Entra users by automating basic lifecycle processes. -- **Role-Based Access Control (RBAC):** Access rights are determined based on the specific roles or job functions of users. Each role is assigned the minimum permissions necessary to fulfill its responsibilities. [Microsoft Entra role-based access control](../../identity/role-based-access-control/custom-overview.md) manages access to Microsoft Entra resources.+- **Role-Based Access Control (RBAC):** Access rights are determined based on the specific roles or job functions of users. Each role is assigned the minimum permissions necessary to fulfill its responsibilities. [Microsoft Entra role-based access control](../../identity/role-based-access-control/custom-overview.md) manages access to Microsoft Entra resources, and entitlement management can be used to implement a role approach for your own and third party applications. - **Just-In-Time Privilege:** Access rights are granted only for the duration of time that they're needed and are revoked when they're no longer required. This reduces the window of opportunity for attackers to exploit excessive privileges. [Privileged Identity Management (PIM)](../../id-governance/privileged-identity-management/pim-configure.md) is a service in Microsoft Entra ID that enables you to manage, control, and monitor access to important resources in your organization and can provide just-in-time access. -- **Regular Auditing and Review:** Periodic reviews of user access and permissions are conducted to ensure that users still require the access they have been granted. This helps to identify and rectify any deviations from the least privilege principle. [Access reviews in Microsoft Entra ID](../access-reviews-overview.md), part of Microsoft Entra, enable organizations to efficiently manage group memberships, access to enterprise applications, and role assignments. User's access can be reviewed regularly to make sure only the right people have continued access.+- **Regular Auditing and Review:** Periodic reviews of user access and permissions are conducted to ensure that users still require the access they have been granted. This helps to identify and rectify any deviations from the least privilege principle. [Access reviews in Microsoft Entra ID](../access-reviews-overview.md), part of Microsoft Entra, enable organizations to efficiently manage group memberships, access to enterprise applications, role assignments, and permissions brought in from applications. User's access can be reviewed regularly to make sure only the right people have continued access. -- **Default Deny:** The default stance is to deny access, and access is explicitly granted only for approved purposes. This contrasts with a "default allow" approach, which can result in granting unnecessary privileges. [Entitlement management](../entitlement-management-overview.md) is an identity governance feature that enables organizations to manage identity and access lifecycle at scale, by automating access request workflows, access assignments, reviews, and expiration.+- **Default Deny:** The default stance is to deny access, and access is explicitly granted only for approved purposes. This contrasts with a "default allow" approach, which can result in granting unnecessary privileges. ++- **Delegation:** [Entitlement management](../entitlement-management-overview.md) is an identity governance feature that enables organizations to manage identity and access lifecycle at scale, by automating access request workflows, access assignments, reviews, and expiration. This includes assigning approval and review tasks to the relevant decision makers, such as managers, sponsors or resource owners, who can confirm when access is no longer required as the subject's job role or tasks have changed. By following the principle of least privilege, your organization can reduce the risk of security issues, and ensure that access controls are aligned with business needs.