# Access packages should not reference inactive or orphaned assignment policies

This test identifies Microsoft Entra ID Governance access packages that contain assignment policies which are disabled, misconfigured, or orphaned.

Source: https://maester.dev/docs/tests/MT.1108

<!-- This file is generated by website/scripts/generate-test-docs.mjs. Do not edit manually. -->

<div class="test-byline"><div class="test-byline-avatars"><a class="test-byline-avatar test-byline-avatar--author" href="/contributors/nicowyss" title="nicowyss · Original author"><img src="https://github.com/nicowyss.png" alt="nicowyss" width="28" height="28" loading="lazy" decoding="async" /></a><a class="test-byline-avatar" href="/contributors/jeanphilippegeorge" title="Jean-Philippe George · Co-contributor"><img src="https://github.com/JeanPhilippeGeorge.png" alt="Jean-Philippe George" width="28" height="28" loading="lazy" decoding="async" /></a></div><div class="test-byline-meta"><span class="test-byline-text">Contributed by <a href="/contributors/nicowyss">nicowyss</a> with <a href="/contributors/jeanphilippegeorge">Jean-Philippe George</a></span><a class="test-byline-link" href="/contributors">All contributors →</a></div></div>

<p class="test-part">Part of <a href="/docs/tests/maester">Maester</a> · Entra ID · Identity Governance · <a href="/docs/tests">All checks</a></p>

```powershell title="Run this check"
Invoke-Maester -TestId MT.1108
```

## Overview

This test identifies Microsoft Entra ID Governance access packages that contain assignment policies which are disabled, misconfigured, or orphaned. Inactive or misconfigured policies prevent users from successfully requesting access and can break automated provisioning workflows.

The test validates:
- Policies are in "published" state and active
- Requestor scope type is properly configured (not "NoSubjects" or null)
- Required approval settings are complete with designated approvers
- Policies have not expired
- Required questions have proper text configured

## Remediation action

**For Unpublished Policies:**
1. Navigate to [Entra Admin Center → Identity Governance → Access Packages](https://entra.microsoft.com/#view/Microsoft_AAD_ELM/Dashboard.ReactView)
2. Select the affected access package → **Policies** tab
3. Review the policy state:
   - If should be active: Publish it
   - If no longer needed: Delete it

**For Missing Requestor Settings:**
1. Edit the problematic policy → **Requestor** settings
2. Configure **Who can request** with appropriate scope (All users, Specific users, etc.)
3. Ensure scope type is valid and not deprecated

**For Missing/Invalid Approval Settings:**
1. Edit the policy → **Approval** settings
2. If approval required:
   - Add at least one approval stage
   - Configure primary approvers for each stage
   - Ensure approver groups exist
3. If not required: Disable approval requirement

**For Expired Policies:**
1. Review if expiration was intentional
2. If still needed: Edit policy and update expiration date or remove expiration
3. If no longer needed: Delete the policy

**For Question Configuration Issues:**
1. Edit the policy → **Requestor information** section
2. Ensure all required questions have proper text configured
3. Validate question type and requirements

## Related links

- [Microsoft Entra ID Governance Documentation](https://learn.microsoft.com/entra/id-governance/)
- [Access Package Assignment Policies](https://learn.microsoft.com/entra/id-governance/entitlement-management-access-package-request-policy)
- [Configure Access Package Request Settings](https://learn.microsoft.com/entra/id-governance/entitlement-management-access-package-approval-policy)
- [Microsoft Graph API - Assignment Policies](https://learn.microsoft.com/graph/api/resources/accesspackageassignmentpolicy)

## Details

<details>
<summary>Every attribute of this check</summary>

| Field | Value |
| --- | --- |
| Test ID | MT.1108 |
| Severity | Low |
| Suite | Maester |
| Product | Entra ID |
| Feature | Identity Governance |
| Area | Identity lifecycle and hygiene |
| Resource type | AccessPackage |
| User impact | Low |
| Implementation cost | Medium |
| MITRE ATT&CK | None |
| PowerShell test | [Test-MtEntitlementManagementInactivePolicies](https://github.com/maester365/maester/blob/main/tests/maester/entra/Test.MT.1108.ps1) |
| Services | Graph |
| Compatible licenses | AAD_PREMIUM_P2, Entra_Identity_Governance |

</details>

## Source

- Test: [`tests/maester/entra/Test.MT.1108.ps1`](https://github.com/maester365/maester/blob/main/tests/maester/entra/Test.MT.1108.ps1)
- Documentation: [`tests/maester/entra/Test.MT.1108.md`](https://github.com/maester365/maester/blob/main/tests/maester/entra/Test.MT.1108.md)