Access packages should not reference inactive or orphaned assignment policies

Contributed by nicowyss with Jean-Philippe GeorgeAll contributors →

Part of Maester · Entra ID · Identity Governance · All checks

Run this check

Invoke-Maester -TestId MT.1108

Overview

This test identifies Microsoft Entra ID Governance access packages that contain assignment policies which are disabled, misconfigured, or orphaned. Inactive or misconfigured policies prevent users from successfully requesting access and can break automated provisioning workflows.

The test validates:

• Policies are in “published” state and active
• Requestor scope type is properly configured (not “NoSubjects” or null)
• Required approval settings are complete with designated approvers
• Policies have not expired
• Required questions have proper text configured

Remediation action

For Unpublished Policies:

1. Navigate to Entra Admin Center → Identity Governance → Access Packages
2. Select the affected access package → Policies tab
3. Review the policy state:
   • If should be active: Publish it
   • If no longer needed: Delete it

For Missing Requestor Settings:

1. Edit the problematic policy → Requestor settings
2. Configure Who can request with appropriate scope (All users, Specific users, etc.)
3. Ensure scope type is valid and not deprecated

For Missing/Invalid Approval Settings:

1. Edit the policy → Approval settings
2. If approval required:
   • Add at least one approval stage
   • Configure primary approvers for each stage
   • Ensure approver groups exist
3. If not required: Disable approval requirement

For Expired Policies:

1. Review if expiration was intentional
2. If still needed: Edit policy and update expiration date or remove expiration
3. If no longer needed: Delete the policy

For Question Configuration Issues:

1. Edit the policy → Requestor information section
2. Ensure all required questions have proper text configured
3. Validate question type and requirements

Related links

• Microsoft Entra ID Governance Documentation
• Access Package Assignment Policies
• Configure Access Package Request Settings
• Microsoft Graph API - Assignment Policies

Details

Every attribute of this check

Field	Value
Test ID	MT.1108
Severity	Low
Suite	Maester
Product	Entra ID
Feature	Identity Governance
Area	Identity lifecycle and hygiene
Resource type	AccessPackage
User impact	Low
Implementation cost	Medium
MITRE ATT&CK	None
PowerShell test	Test-MtEntitlementManagementInactivePolicies
Services	Graph
Compatible licenses	AAD_PREMIUM_P2, Entra_Identity_Governance

Source

• Test: tests/maester/entra/Test.MT.1108.ps1
• Documentation: tests/maester/entra/Test.MT.1108.md