L15. Entitlement Management: Access Packages and Catalogs
Video generating
Check back soon for the video lesson on Entitlement Management: Access Packages and Catalogs
Implement entitlement management for the SC-300: create access packages that bundle group memberships, app assignments, and SharePoint sites, configure catalogs for delegation, set up approval workflows, and manage access for internal and external users.
What Is Entitlement Management?
Entitlement management automates the access request, approval, and lifecycle process. Instead of having users request access to individual resources one by one, you bundle related resources into access packages that users can request through a self-service portal. Licensing: Entra ID P2 or Entra ID Governance add-on.
Key Components
Catalogs
A catalog is a container for related resources and access packages. Catalogs enable delegation: a catalog owner can manage the resources and policies within their catalog without needing Entra ID admin roles.- General catalog: Created by default, managed by Global Administrators
- Custom catalogs: Created for specific departments, projects, or partner organizations
Resources
Resources that can be added to a catalog:- Entra ID security groups
- Applications (enterprise apps)
- SharePoint Online sites
Access Packages
An access package bundles resources from a catalog with policies that govern who can request, how requests are approved, and how long access lasts.Access Package Policies
Each access package has one or more policies that define:
| Setting | Description |
|---|---|
| Who can request | Internal users, specific groups, connected organizations, or all external users |
| Approval workflow | None, single-stage, or multi-stage with designated approvers |
| Access duration | Time-bound (e.g., 90 days) or permanent until review |
| Access reviews | Recurring recertification of access package assignments |
| Requestor info | Custom questions the requestor must answer |
Connected Organizations
Connected organizations represent external partner companies. When you create a connected organization, you link it to the partner's Entra ID tenant (or other identity provider). Users from connected organizations can then request access packages. Exam tip: Connected organizations are specifically used in entitlement management for external access. This is different from B2B cross-tenant access settings, which control collaboration at the tenant level.
Self-Service Request Portal
Users request access packages through the My Access portal (https://myaccess.microsoft.com):
- User browses available access packages
- User selects a package and submits a request
- The request follows the approval workflow defined in the policy
- If approved, access is automatically provisioned
- When access expires or is revoked, resources are automatically removed
Separation of Duties
Entitlement management supports incompatible access packages: you can mark two access packages as incompatible so that a user cannot hold both simultaneously. This enforces separation of duties without manual checking. Exam tip: Incompatible access packages are the entitlement management answer to separation of duties. If a question asks how to prevent a user from having two conflicting access sets, configure the packages as incompatible.
Custom Extensions
Access packages support custom extensions through Logic Apps. When an access package is assigned, renewed, or removed, a Logic App can be triggered to perform additional actions (e.g., create a mailbox, send a Teams notification, provision an account in a third-party system).
- ✓Catalogs enable delegation: catalog owners can manage resources and policies without Entra ID admin roles
- ✓An access package can have multiple policies targeting different requestor groups with different approval workflows
- ✓Connected organizations link external partner tenants for access package requests
- ✓Incompatible access packages enforce separation of duties by preventing a user from holding conflicting access
- ✓Access packages can bundle groups, applications, and SharePoint sites into a single requestable unit
- ✓Custom extensions via Logic Apps allow additional automated actions when access packages are assigned or removed
1. A company needs to prevent a user from having both Finance Approver and Finance Auditor access packages simultaneously. How should this be configured?
2. What is the purpose of a catalog in entitlement management?
3. Where do users request access packages in the self-service portal?