# All entitlement management policies that apply to External users require approval
Access package assignment policies that allow external users to request access should require approval.
Source: https://maester.dev/docs/tests/ZTA.21879
## Overview
Access package assignment policies that allow external users to request access should require approval. Without an approval gate, external users can self-provision access to organizational resources without oversight. Requiring approval ensures that a designated approver reviews each request, providing an opportunity to validate the requestor's identity and business justification before granting access.
## Remediation
- [Configure approval for access package assignment policies](https://learn.microsoft.com/entra/id-governance/entitlement-management-access-package-approval-policy?wt.mc_id=zerotrustrecommendations_automation_content_cnl_csasci)
- [Review access package policies for external users](https://learn.microsoft.com/entra/id-governance/entitlement-management-access-package-request-policy?wt.mc_id=zerotrustrecommendations_automation_content_cnl_csasci)
## Run it
The check runs as part of the whole assessment, with the ZeroTrustAssessment module installed:
```powershell
Install-Module ZeroTrustAssessment -Scope CurrentUser
Connect-Maester
Invoke-Maester -Pack ZTA -SkipBuiltIn
```
Leave out `-SkipBuiltIn` to run Maester's own checks in the same run.
About this check
| | |
| --- | --- |
| Severity | Medium |
| Effort to fix | Medium |
| Impact on users | Medium |
| Pillar | Identity |
| Category | Access control |
| Product | [Entra ID](/docs/tests/products/entra) |
| Feature | Identity Governance |
| Area | External access and sharing |
| ATT&CK | [T1078.004](/docs/tests?mitre=T1078.004) Cloud Accounts, [T1199](/docs/tests?mitre=T1199) Trusted Relationship |
| Licence | P2 |
| Tenant | Workforce, External |
Product, feature, area and ATT&CK are Maester's: the assessment does not record them, so Maester keeps them in the pack's `taxonomy.json`.