Access packages and catalogs should not reference deleted groups

Contributed by nicowyss with Jean-Philippe GeorgeAll contributors →

Part of Maester · Entra ID · Identity Governance · All checks

Run this check

Invoke-Maester -TestId MT.1107

Overview

This test identifies Microsoft Entra ID Governance access packages and catalogs that contain references to deleted Entra ID groups. Deleted group references can cause access provisioning failures, broken approval workflows, and compliance violations.

The test validates:

• Groups assigned as resources in access packages still exist
• Groups configured as approvers in assignment policies are active
• Groups registered in catalogs have not been deleted

For any deleted groups found, the test attempts to retrieve the group name from the recycle bin (directory/deletedItems) to help identify which groups need attention.

Remediation action

Option 1: Remove Deleted Group References

1. Navigate to Entra Admin Center → Identity Governance → Access Packages
2. For each affected access package:
   • Go to Resources and remove the deleted group
   • Update assignment policies to remove deleted group approvers
3. For affected catalogs:
   • Select the catalog → Resources
   • Remove the deleted group

Option 2: Restore Deleted Groups

1. Navigate to Entra Admin Center → Identity → Groups → Deleted groups
2. Select the deleted group(s) and click Restore group
3. Re-run the test to confirm resolution

Option 3: Replace with Active Groups

1. Create or identify replacement active groups
2. Add new groups to access packages/catalogs
3. Update assignment policies with new approver groups
4. Remove deleted group references

Related links

• Microsoft Entra ID Governance Documentation
• Access Packages Overview
• Manage Resources in Access Packages
• Access Package Catalogs
• Microsoft Graph API - Entitlement Management

Details

Every attribute of this check

Field	Value
Test ID	MT.1107
Severity	Low
Suite	Maester
Product	Entra ID
Feature	Identity Governance
Area	Identity lifecycle and hygiene
Resource type	AccessPackage
User impact	Low
Implementation cost	Medium
MITRE ATT&CK	None
PowerShell test	Test-MtEntitlementManagementDeletedGroups
Services	Graph
Compatible licenses	AAD_PREMIUM_P2, Entra_Identity_Governance

Source

• Test: tests/maester/entra/Test.MT.1107.ps1
• Documentation: tests/maester/entra/Test.MT.1107.md