Solutions
Treat temporary access as a full lifecycle.
Connect independent approval, verified membership and accountable cleanup.
The work to improve
An approved access request is incomplete if nobody can explain when access ends or what happens when removal fails.
Each grant is tied to the reviewed request and the recipient’s explicit identity mapping. The server checks current authority and reads Microsoft Graph to observe the result.
Periodic reviews can retain access within its existing expiry or end it. A missed review queues removal, and a provider failure remains an operational issue to resolve rather than a completed result.
What changes for your team
- Keep access intent, duration and reviewer history together.
- See observed grant and removal results.
- Make exceptions actionable for the assigned operators.
What you can explore in Vision
- Explicit Entra identity mappings and approved security groups
- Optional bounded extensions and periodic access reviews
- Durable removal tracking and recovery actions
Questions worth asking
Does Vision support every Entra group type?
No. The supported flow uses approved static security-enabled, non-mail-enabled, non-role-assignable groups in the global Microsoft cloud.
Can recipients extend their own access?
They can request more time when the catalog permits it; an independent assigned reviewer must approve before expiry.
What if removal cannot be confirmed?
The run shows Removal needs help and retains cleanup work for retry. Operators must restore the required provider and worker availability.
Scope and availability
- Requires enabled ITSM, configured Graph application permissions and a controlled directory pilot.
- Expiry is application-scheduled; outages can delay cleanup. This is not Microsoft PIM or broad identity governance.