# No catalog should contain resources without any associated access packages

This test identifies Microsoft Entra ID Governance access package catalogs that contain resources (groups, applications, SharePoint sites) that are not…

Source: https://maester.dev/docs/tests/MT.1110

<!-- This file is generated by website/scripts/generate-test-docs.mjs. Do not edit manually. -->

<div class="test-byline"><div class="test-byline-avatars"><a class="test-byline-avatar test-byline-avatar--author" href="/contributors/nicowyss" title="nicowyss · Original author"><img src="https://github.com/nicowyss.png" alt="nicowyss" width="28" height="28" loading="lazy" decoding="async" /></a><a class="test-byline-avatar" href="/contributors/jeanphilippegeorge" title="Jean-Philippe George · Co-contributor"><img src="https://github.com/JeanPhilippeGeorge.png" alt="Jean-Philippe George" width="28" height="28" loading="lazy" decoding="async" /></a></div><div class="test-byline-meta"><span class="test-byline-text">Contributed by <a href="/contributors/nicowyss">nicowyss</a> with <a href="/contributors/jeanphilippegeorge">Jean-Philippe George</a></span><a class="test-byline-link" href="/contributors">All contributors →</a></div></div>

<p class="test-part">Part of <a href="/docs/tests/maester">Maester</a> · Entra ID · Identity Governance · <a href="/docs/tests">All checks</a></p>

```powershell title="Run this check"
Invoke-Maester -TestId MT.1110
```

## Overview

This test identifies Microsoft Entra ID Governance access package catalogs that contain resources (groups, applications, SharePoint sites) that are not used in any access package within that catalog. Orphaned resources indicate incomplete configuration or drift.

The test validates:
- All catalog resources are referenced in at least one access package
- No orphaned or unused resources exist in catalogs
- Resources serve their intended governance purpose

Common scenarios detected:
- Resources added to catalog but package not yet configured
- Access package was deleted but resource remained in catalog
- Resources removed from packages but not from catalog
- Test resources added and never cleaned up

## Remediation action

**Option 1: Add to Access Package** (if resource should be governed)
1. Navigate to [Entra Admin Center → Identity Governance → Catalogs](https://entra.microsoft.com/#view/Microsoft_AAD_ELM/Dashboard.ReactView)
2. Open an existing access package or create a new one
3. Add the resource to the package's resource roles
4. Configure appropriate roles and permissions
5. Update package policies as needed

**Option 2: Remove from Catalog** (if resource no longer needed)
1. Navigate to [Entra Admin Center → Identity Governance → Catalogs](https://entra.microsoft.com/#view/Microsoft_AAD_ELM/Dashboard.ReactView)
2. Select the catalog → **Resources** section
3. Select the unused resource
4. Click **Remove from catalog**
5. Confirm removal

**Bulk Remediation Process:**
1. Review with stakeholders to identify which resources are still needed
2. Create access packages for resources that should be governed
3. Clean up catalog by removing resources no longer needed
4. Document decisions and update procedures

## Related links

- [Microsoft Entra ID Governance Documentation](https://learn.microsoft.com/entra/id-governance/)
- [Access Package Catalogs](https://learn.microsoft.com/entra/id-governance/entitlement-management-catalog-create)
- [Manage Catalog Resources](https://learn.microsoft.com/entra/id-governance/entitlement-management-access-package-resources)
- [Microsoft Graph API - Entitlement Management](https://learn.microsoft.com/graph/api/resources/entitlementmanagement-overview)

## Details

<details>
<summary>Every attribute of this check</summary>

| Field | Value |
| --- | --- |
| Test ID | MT.1110 |
| Severity | Low |
| Suite | Maester |
| Product | Entra ID |
| Feature | Identity Governance |
| Area | Identity lifecycle and hygiene |
| Resource type | AccessPackage |
| User impact | Low |
| Implementation cost | Medium |
| MITRE ATT&CK | None |
| PowerShell test | [Test-MtEntitlementManagementOrphanedResources](https://github.com/maester365/maester/blob/main/tests/maester/entra/Test.MT.1110.ps1) |
| Services | Graph |
| Compatible licenses | AAD_PREMIUM_P2, Entra_Identity_Governance |

</details>

## Source

- Test: [`tests/maester/entra/Test.MT.1110.ps1`](https://github.com/maester365/maester/blob/main/tests/maester/entra/Test.MT.1110.ps1)
- Documentation: [`tests/maester/entra/Test.MT.1110.md`](https://github.com/maester365/maester/blob/main/tests/maester/entra/Test.MT.1110.md)