Feature 2: Entra Entitlement Management Setup Guide

ADO Feature: #37967428
Tenant: adaptivecloudlab.com (d1623670-9777-4399-aaf6-01d87b84ef1d)
Goal: Users self-request access to lab workloads via My Access portal instead of contacting Michael.

Overview

Entra Identity Governance → Entitlement Management allows you to create access packages that users can request. Each package bundles group memberships, and approval/lifecycle policies control who gets access and for how long.

User experience after setup:
1. User goes to https://myaccess.microsoft.com
2. Browses the "ACX Lab" catalog
3. Requests an access package (e.g., "Azure Local VMs")
4. Gets auto-approved (or admin-approved for sensitive packages)
5. Membership expires after 90 days (renewable)

Prerequisites

Global Admin or Identity Governance Administrator role in the adaptivecloudlab.com tenant
Existing security groups (these should already exist from ACX-Registration):
ACX-AzureLocalVMs — Azure Local VM access
ACX-ArcAKS — AKS Arc cluster access
ACX-AVD — Azure Virtual Desktop access
ACX-Migrate — Migration tooling access
ACX-Lab-Admins — Admin access

Step 1: Create the ACX Lab Catalog

Go to Azure Portal → Identity Governance → Entitlement Management → Catalogs
Click + New catalog
Configure:
Name: ACX Lab
Description: Self-service access packages for ACX Lab workloads
Enabled: Yes
Enabled for external users: Yes (for guest users)
Click Create

Add Resources to Catalog

Open the ACX Lab catalog → Resources → + Add resources
Select Groups and Teams
Add all 5 groups:
ACX-AzureLocalVMs
ACX-ArcAKS
ACX-AVD
ACX-Migrate
ACX-Lab-Admins
Click Add

Step 2: Create Access Packages

Create one access package per workload type. Repeat for each:

Package 1: Azure Local VMs

Catalogs → ACX Lab → Access packages → + New access package
Basics:
Name: Azure Local VMs
Description: Grants access to provision and manage VMs on Azure Local (HCI) clusters. Includes RDP access to Toronto site VMs.
Catalog: ACX Lab
Resource roles:
Group: ACX-AzureLocalVMs → Role: Member
Requests (who can request):
Select For users in your directory
Specific users/groups: All members (or a specific org group if you want to limit)
Require approval: No (auto-approve for standard access)
Require requestor justification: Yes
Requestor information:
Add question: "What project/scenario do you need VMs for?" (required, text)
Lifecycle:
Expiration: 90 days
Allow users to request extension: Yes
Require approval for extension: No
Review + Create → Create

Package 2: AKS Arc Clusters

Same flow, with: - Name: AKS Arc Clusters - Description: Grants access to AKS Arc clusters for container workloads. Includes namespace provisioning on Toronto-aksArc, tor-aksvi (GPU), and tor-azcpe-aksarc1. - Group: ACX-ArcAKS → Role: Member - Expiration: 90 days - Approval: No

Package 3: Azure Virtual Desktop

Same flow, with: - Name: Azure Virtual Desktop (AVD) - Description: Grants access to AVD session hosts for remote desktop scenarios. - Group: ACX-AVD → Role: Member - Expiration: 90 days - Approval: No

Package 4: Migration Tooling

Same flow, with: - Name: Migration Tooling - Description: Grants access to Azure Migrate appliances and migration assessment tools. - Group: ACX-Migrate → Role: Member - Expiration: 90 days - Approval: No

Package 5: Lab Admin (Elevated)

This one requires approval: - Name: ACX Lab Admin - Description: Elevated admin access to manage all lab resources, run cleanup, and view all user data. Requires approval from current admin. - Group: ACX-Lab-Admins → Role: Member - Requests: - Require approval: Yes - First approver: Michael Godfrey (migodfre@microsoft.com) - Fallback approver: (add your backup) - Days until request expires if not acted on: 14 - Require justification: Yes - Lifecycle: - Expiration: 180 days - Require approval for extension: Yes - Access reviews: Every 90 days (see Step 4)

Step 3: Configure Connected Organizations (for Guests)

If external guests need to request access:

Identity Governance → Entitlement Management → Connected organizations
+ Add connected organization
Add the organizations that send guest users to the lab (e.g., partner tenants)
Go back to each access package → Requests tab → add a policy for Users not in your directory from connected orgs

Step 4: Set Up Access Reviews (Admin Package)

Open the ACX Lab Admin access package → Lifecycle → Access reviews
Configure:
Review frequency: Every 90 days
Duration: 14 days
Reviewers: Self-review + Michael Godfrey
If reviewers don't respond: Remove access
Apply results automatically: Yes

Step 5: Test the Flow

Sign in as a test user at https://myaccess.microsoft.com
Go to Access packages → Available
You should see the ACX Lab catalog packages
Request Azure Local VMs with a justification
Verify:
Auto-approved immediately (no approval required)
User added to ACX-AzureLocalVMs group
90-day expiration set
Test the Admin package with a different user to verify approval flow

Step 6: Update ACX-Registration to Check Entitlement

Optionally, update the registration app to check if a user already has an active access package assignment before manually adding them to groups. This prevents duplicate assignments.

// In guestAccountService.js — check if user already has entitlement
const entitlementAssignment = await graphClient
  .api(`/identityGovernance/entitlementManagement/assignments`)
  .filter(`targetId eq '${userObjectId}' and state eq 'Delivered'`)
  .get();

if (entitlementAssignment.value.length > 0) {
  logger.info(`User ${email} already has active entitlement, skipping group add`);
  return;
}

Step 7: Communicate to Users

Send an announcement to the ACX Lab users:

Subject: Self-Service Access for ACX Lab

You can now request access to lab workloads without contacting an admin:

Go to https://myaccess.microsoft.com

Browse Access packages → look for "ACX Lab" packages

Request the workload you need (Azure Local VMs, AKS Arc, AVD, Migrate)

Access is granted immediately — no approval wait!

Access expires after 90 days and is renewable. For Admin access, approval is required.

PowerShell Alternative (Graph API)

If you prefer scripting over portal clicks:

# Install the module
Install-Module Microsoft.Graph.Identity.Governance -Force

# Connect
Connect-MgGraph -Scopes "EntitlementManagement.ReadWrite.All"

# Create catalog
$catalog = New-MgEntitlementManagementCatalog -DisplayName "ACX Lab" `
    -Description "Self-service access packages for ACX Lab workloads" `
    -IsExternallyVisible $true

# Add group resource to catalog
$group = Get-MgGroup -Filter "displayName eq 'ACX-AzureLocalVMs'"
New-MgEntitlementManagementCatalogResource -CatalogId $catalog.Id `
    -Resource @{
        OriginId = $group.Id
        OriginSystem = "AadGroup"
        DisplayName = $group.DisplayName
    } `
    -RequestType "AdminAdd"

# Create access package
$package = New-MgEntitlementManagementAccessPackage `
    -DisplayName "Azure Local VMs" `
    -Description "Grants access to provision and manage VMs on Azure Local clusters" `
    -CatalogId $catalog.Id

# Add resource role to package
$catalogResource = Get-MgEntitlementManagementCatalogResource -CatalogId $catalog.Id `
    -Filter "displayName eq 'ACX-AzureLocalVMs'"
$role = Get-MgEntitlementManagementCatalogResourceRole -CatalogId $catalog.Id `
    -Filter "originId eq 'Member_$($group.Id)'"

New-MgEntitlementManagementAccessPackageResourceRoleScope -AccessPackageId $package.Id `
    -Role @{ Id = $role.Id; OriginId = $role.OriginId; OriginSystem = "AadGroup" } `
    -Scope @{ Id = $catalogResource.Id; OriginId = $group.Id; OriginSystem = "AadGroup" }

# Create auto-approve policy
New-MgEntitlementManagementAssignmentPolicy `
    -AccessPackageId $package.Id `
    -DisplayName "Auto-approve for all members" `
    -AllowedTargetScope "allMemberUsers" `
    -Expiration @{ Type = "afterDuration"; Duration = "P90D" } `
    -RequestorSettings @{ EnableTargetsToSelfAddAccess = $true; AllowCustomAssignmentSchedule = $false } `
    -RequestApprovalSettings @{ IsApprovalRequiredForAdd = $false }

Verification Checklist

[ ] Catalog "ACX Lab" created and visible
[ ] All 5 security groups added as catalog resources
[ ] 5 access packages created (4 auto-approve + 1 admin with approval)
[ ] Test user can see and request packages at myaccess.microsoft.com
[ ] Auto-approve works for standard packages
[ ] Approval flow works for Admin package
[ ] 90-day expiration is set correctly
[ ] Access review configured for Admin package
[ ] External users (guests) can request from connected orgs
[ ] User communication sent