<!-- Copyright (c) 2026 defconxt. All rights reserved. -->
<!-- Licensed under AGPL-3.0 — see LICENSE file for details. -->
---
name: implementing-identity-governance
description: >-
  Implement identity governance and administration (IGA) including access
  reviews, entitlement management, lifecycle workflows, separation of duties
  enforcement, and access certification campaigns. Covers Azure AD Identity
  Governance, Okta Governance, and SailPoint integration patterns.
domain: cybersecurity
subdomain: identity-access-management
tags:
  - identity-governance
  - access-reviews
  - entitlement-management
  - lifecycle-workflows
  - separation-of-duties
  - azure-ad
  - compliance
version: "1.0"
author: defconxt
license: AGPL-3.0
metadata:
  mitre-attack: ["T1078"]
---

# Implementing Identity Governance

## Overview

Identity Governance ensures the right people have the right access at the right
time — and can prove it. Without governance, entitlements accumulate (permission
creep), orphaned accounts persist, and separation of duties violations go
undetected. IGA programs combine automated access reviews, entitlement catalogs,
lifecycle automation, and compliance reporting to maintain least privilege at
organizational scale.

Mode: `[MODE: ARCHITECT]` for governance design; `[MODE: BLUE]` for compliance monitoring.

MITRE ATT&CK: T1078 (Valid Accounts), T1098 (Account Manipulation)

## Prerequisites

- Azure AD P2 (Identity Governance, Access Reviews)
- Okta Identity Governance (or Okta Lifecycle Management)
- HR system integration (Workday, SAP SuccessFactors)
- Python 3.10+ for agent tooling
- Compliance requirements mapping (SOX, SOC2, HIPAA)

## Key Concepts

### Governance Controls Matrix

| Control | Purpose | Frequency |
|---------|---------|-----------|
| Access Reviews | Validate continued need | Quarterly |
| Entitlement Catalog | Self-service with approval | Continuous |
| Lifecycle Workflows | Joiner/mover/leaver automation | Event-driven |
| SoD Policies | Prevent toxic combinations | Real-time enforcement |
| Access Certification | Compliance attestation | Annually / audit-driven |
| Orphan Account Detection | Find accounts without owners | Monthly |

### Azure AD Access Reviews

```powershell
# Connect to Microsoft Graph
Connect-MgGraph -Scopes "AccessReview.ReadWrite.All"

# Create access review for Global Admin role
$reviewParams = @{
    DisplayName = "Global Admin Quarterly Review — Q1 2026"
    DescriptionForAdmins = "Review all Global Administrator assignments"
    Scope = @{
        Query = "/roleManagement/directory/roleAssignments?\$filter=roleDefinitionId eq '62e90394-69f5-4237-9190-012177145e10'"
        QueryType = "MicrosoftGraph"
    }
    Reviewers = @(@{
        Query = "/users/security-reviewer-id"
        QueryType = "MicrosoftGraph"
    })
    Settings = @{
        MailNotificationsEnabled = $true
        JustificationRequiredOnApproval = $true
        DefaultDecisionEnabled = $true
        DefaultDecision = "Deny"
        AutoApplyDecisionsEnabled = $true
        Recurrence = @{
            Pattern = @{ Type = "absoluteMonthly"; Interval = 3 }
            Range = @{ Type = "noEnd"; StartDate = "2026-01-01" }
        }
        InstanceDurationInDays = 14
    }
}
New-MgIdentityGovernanceAccessReviewDefinition -BodyParameter $reviewParams

# List active access reviews
Get-MgIdentityGovernanceAccessReviewDefinition |
  Select-Object DisplayName, Status, Scope

# Get review decisions
Get-MgIdentityGovernanceAccessReviewDefinitionInstanceDecision `
    -AccessReviewScheduleDefinitionId "REVIEW_ID" `
    -AccessReviewInstanceId "INSTANCE_ID" |
  Select-Object Principal, Decision, Justification
```

### Entitlement Management

```powershell
# Create access package catalog
$catalog = @{
    DisplayName = "Engineering Resources"
    Description = "Access packages for engineering team resources"
    IsExternallyVisible = $false
}
New-MgEntitlementManagementCatalog -BodyParameter $catalog

# Create access package with auto-assignment policy
$package = @{
    DisplayName = "Engineering - Production Read Access"
    Description = "Read-only access to production resources"
    CatalogId = "CATALOG_ID"
}
New-MgEntitlementManagementAccessPackage -BodyParameter $package

# Create assignment policy with manager approval
$policy = @{
    DisplayName = "Manager Approval Policy"
    AccessPackageId = "PACKAGE_ID"
    RequestApprovalSettings = @{
        IsApprovalRequired = $true
        ApprovalStages = @(@{
            ApprovalStageTimeOutInDays = 7
            PrimaryApprovers = @(@{
                OdataType = "#microsoft.graph.requestorManager"
                ManagerLevel = 1
            })
        })
    }
    AccessReviewSettings = @{
        IsEnabled = $true
        RecurrenceType = "quarterly"
        DurationInDays = 14
    }
}
```

### Lifecycle Workflows

```powershell
# Create joiner workflow — pre-hire provisioning
$workflow = @{
    DisplayName = "New Employee Onboarding"
    Category = "joiner"
    IsEnabled = $true
    IsSchedulingEnabled = $true
    ExecutionConditions = @{
        Scope = @{
            OdataType = "#microsoft.graph.identityGovernance.ruleBasedSubjectSet"
            Rule = "(department eq 'Engineering')"
        }
        Trigger = @{
            OdataType = "#microsoft.graph.identityGovernance.timeBasedAttributeTrigger"
            TimeBasedAttribute = "employeeHireDate"
            OffsetInDays = -7
        }
    }
    Tasks = @(
        @{
            DisplayName = "Generate TAP"
            TaskDefinitionId = "1b555e50-7f65-41d5-b514-5894a026d10d"
            IsEnabled = $true
        }
        @{
            DisplayName = "Add to Engineering group"
            TaskDefinitionId = "22085229-5809-45e8-97fd-270d28d66910"
            IsEnabled = $true
            Arguments = @(@{
                Name = "groupID"
                Value = "ENGINEERING_GROUP_ID"
            })
        }
    )
}
New-MgIdentityGovernanceLifecycleWorkflow -BodyParameter $workflow
```

## Workflow

1. **Map** — Document all access entitlements and their business owners
2. **Catalog** — Build access package catalog aligned to job functions
3. **Automate** — Implement joiner/mover/leaver lifecycle workflows
4. **Review** — Schedule access reviews for all privileged and sensitive roles
5. **Enforce SoD** — Define and enforce separation of duties policies
6. **Certify** — Run annual compliance certification campaigns
7. **Report** — Generate governance dashboards for audit evidence

## Detection

```yaml
title: Identity Governance Detection
id: a29ac23c-e8d1-45e4-abf1-36a0bcee687d
status: experimental
description: Detects suspicious activity related to implementing identity governance techniques in identity access management context
logsource:
  category: authentication
  product: windows
detection:
  selection:
    EventType: authentication
    Status: failure
  condition: selection
level: medium
tags:
  - attack.t1078
  - attack.credential_access
falsepositives:
  - Automated password rotation by privileged access management tools
```

## Verification

- [ ] Access reviews scheduled for all privileged role assignments (quarterly)
- [ ] Default review decision set to "Deny" (auto-remove on non-response)
- [ ] Entitlement catalog covers all critical application access
- [ ] Joiner/mover/leaver lifecycle workflows active for all departments
- [ ] Separation of duties policies enforced (e.g., no Billing + Global Admin)
- [ ] Orphaned accounts detected and disabled within 30 days of termination
- [ ] Governance metrics dashboard operational (review completion, SoD violations)
- [ ] Annual access certification evidence retained for audit

## References

- [Azure AD Identity Governance](https://learn.microsoft.com/en-us/entra/id-governance/)
- [NIST SP 800-53 AC-2 — Account Management](https://csf.tools/reference/nist-sp-800-53/r5/ac/ac-2/)
- [SOX Section 404 — Internal Controls](https://www.sec.gov/rules/final/33-8238.htm)
- [ISACA COBIT — Access Management](https://www.isaca.org/resources/cobit)
- [MITRE ATT&CK T1078](https://attack.mitre.org/techniques/T1078/)
