If you want stale access removed in Microsoft Entra, use lifecycle workflows to do the day-to-day joiner, mover, and leaver tasks, then use access reviews to confirm people still need access, and entitlement management to govern packaged access for employees or guests. That combination is the most practical way for a small IT team to turn identity governance into real cleanup instead of just paperwork.
The problem is familiar: accounts are created quickly, role changes happen informally, and old app access lingers long after a project ends. Microsoft’s current guidance separates the work into three tools. Lifecycle workflows automate user lifecycle tasks, access reviews recertify access, and entitlement management handles policy-based access packages and recurring review for governed access. Those features are part of Microsoft Entra ID Governance, and some access review capabilities also work with Microsoft Entra ID P2. Licensing varies by capability, so verify your tenant’s edition before you design the process. Lifecycle workflows can run scheduled or on-demand tasks, access reviews help recertify group, app, and role access, and entitlement management adds access packages, approvals, expirations, and recurring reviews.
Start with joiner, mover, and leaver design
Microsoft defines lifecycle workflows around three phases: joiner, mover, and leaver. A joiner is someone who needs access when they enter the organization; a mover changes role or department; a leaver no longer needs access. Workflows are made of tasks plus execution conditions, and they can run before, during, or after an event. That matters because the best cleanup happens before access becomes a problem.
For a small team, start with the highest-risk tasks first:
- Joiner: enable the account, send a welcome email, add the user to the right groups, and assign any access package needed for day-one work.
- Mover: notify the manager, adjust group memberships, and remove access that no longer fits the new role.
- Leaver: disable the account, remove group and team memberships, remove licenses, and delete the user if that matches your policy.
Microsoft documents built-in workflow tasks such as adding and removing users from groups and teams, enabling or disabling the account, removing licenses, and removing access package assignments. The same guidance also notes that workflows can generate temporary access pass credentials and can call custom task extensions through Azure Logic Apps for more complex steps. If you need a custom task, verify whether you can keep it simple enough to support and audit. The deployment guide recommends combining lifecycle workflows with HR-driven provisioning and other automation, but it also warns that timelines are estimates and vary by environment.
Tradeoff: workflows are best for repeatable, rules-based actions. They are not the right place to settle unclear exceptions. If your joiner and leaver rules are still debated every week, document the process first and automate later.
Use access reviews to catch what automation misses
Access reviews are the cleanup layer. Microsoft says they are used to manage group memberships, enterprise application access, and role assignments, and that reviewers can be resource owners, managers, selected delegates, or the users themselves. Reviews can recur weekly, monthly, quarterly, or annually, and reviewers can approve or deny continued access. Access reviews can also use recommendations based on sign-in or access data, and when configured to auto-apply results, Microsoft can remove users who are not approved. The deployment planning guide says access reviews can be scheduled or ad hoc, delegated to business owners, and used to automate removal outcomes.
A useful pattern is this:
- Use lifecycle workflows to create the baseline access for a new hire.
- Use mover workflows to remove obvious stale access when someone changes roles.
- Use access reviews to confirm that remaining access is still needed.
- Remove whatever the review identifies, then verify the cleanup.
This is especially useful when automation is not possible. Microsoft notes that reviews are appropriate when HR data is not authoritative in Entra, when users need temporary leftover access to train replacements, when a group has changed purpose, or when you need to recertify privileged or business-critical access. Reviews are also useful for guest users, because external access often needs periodic reconfirmation even when employee access is automated. Small teams should be careful here: do not assume a review completion means the access is actually gone. Check the post-review state in the group, app, or role after the review ends.
Turn review results into account cleanup
A review only helps if the result is applied and verified. Microsoft says you can configure access reviews to automatically apply outcomes, including removing group membership, app assignment, or the right to elevate to a privileged role. The same guidance also says reviewers can select “take recommendations” and that those recommendations are based on the criteria in the review. That means the cleanup logic should be explicit before the review starts.
For example, if your goal is to remove stale access, define the rule in plain language:
- Review members with no interactive sign-in in 90 days.
- Review all guests in a project group every quarter.
- Review access to a line-of-business app before renewal.
Then decide what happens next:
- Remove from group or app assignment.
- Remove all access package assignments, if the package is the source of access.
- Disable the account or delete it only if the leaver process requires that outcome.
Verification matters more than the button click. After the review closes, check the resulting membership or assignment state in Microsoft Entra. Confirm that the account was removed from the target group, app assignment, or access package, and keep the audit trail. Microsoft’s guidance highlights workflow history and audit logs for troubleshooting and compliance, and access review planning recommends a pilot with noncritical resources, valid email addresses, and audit log monitoring. Those checks are boring, but they are what prove the cleanup happened.
Where entitlement management fits
Entitlement management is the packaged-access option. Microsoft describes an access package as a grouping of policy-governed resources such as SharePoint sites, enterprise applications, Teams, and Microsoft 365 Groups. Access packages can use approvals, expiration, and recurring reviews, and delegated non-admins can manage catalogs and packages. That makes entitlement management useful when access needs to be requested by process instead of granted ad hoc.
Use it when the same set of resources is granted together, especially for projects, contractors, or guests. For external users, Microsoft recommends approvals, expirations, and regular reviews; the documentation suggests quarterly or more frequent reviews for packages that support external access. If your package does not expire, the review process becomes even more important. The tradeoff is administrative structure: entitlement management is more formal than a simple group, but that structure is exactly what makes the access easier to govern.
For a small IT team, the practical path is to start with one or two high-value packages, not the whole environment. Build the package, assign the owner, set the approval path, define the expiration, and schedule the review. Then watch whether the outcome actually reduces stale access and cleanup work.
A simple operating model for small teams
Keep the process lightweight:
- Use lifecycle workflows for day-one access and departure cleanup.
- Use access reviews for anything that can drift over time.
- Use entitlement management when access should be requested, approved, time-limited, and reviewed as a package.
- Pilot first, then expand.
- Verify every removal against the live resource, not just the report.
If you want one decision rule, use this: automate what is predictable, review what is debatable, and verify what was removed. That is the shortest path from identity governance to real account cleanup.