Azure Role assignments can now be governed via Entitlement Management

You can now govern eligible and active assignments to Azure roles at the Management Group, Subscription, and Resource Group levels directly through access packages. This brings role assignment into the same request, approval, and lifecycle governance model as apps, groups, and more - making it easier to manage access to Azure resources at scale while aligning to least privilege and just-in-time access.

Affected: Microsoft Entra ID, Entitlement Management

Related changes

• Revoke previously approved access package assignments in My Access · Assignments
• New built-in Entra role for SOC identity response in Microsoft Defender · Role
• Azure Entra ID Spoofing Vulnerability · Azure
• External users can be directly assigned to Access Packages · Microsoft Entra ID
• As an AP requestor, I can see in My Access who my approver(s) are if the access package owner allows me to · Microsoft Entra ID
• Microsoft Entra Kerberos key rotation improved reliability for incoming trust referral flows · Microsoft Entra ID

View at Microsoft → Copy summary