By Nicholas Hunt — Chief Identity Officer, From the CIdO
Microsoft has made identity governance something more and more enterprises already own, or soon will. That is good news with a bad assumption hiding inside it: that owning Entra ID Governance means your access is governed.
It doesn’t. The license covers your users. Governance only acts on the applications Entra can reach.
Microsoft 365 E5 includes Entra ID P2, but Microsoft says “no new Identity Governance & Administration (IGA) features or capabilities will be added to the Microsoft Entra ID P2 SKU” (Microsoft Learn). Microsoft 365 E7, generally available since May 1 at $99 per user per month (Microsoft 365 Blog), “includes all ID Governance features through the Entra Suite and Agent 365” (Microsoft Learn). Licensing is per user in scope, not per application. A tenant can be fully licensed and still govern half its estate.
Microsoft Ignite (November 17–20) will add more features. The better question is what Entra can reach.
Reviewed is not remediated
Entra ID Governance can review apps it cannot provision: import the users, create app-role assignments, run the campaign (Microsoft Learn). It can’t act on the result inside the app. Removing the assignment can block a federated sign-in, but the account and its entitlements stay until someone removes them. For an app with its own directory that isn’t integrated for provisioning, Microsoft’s guidance says that once the review is complete “you may need to manually update the application’s internal database or directory to remove those users who were denied” (Microsoft Learn). The documented fallback is a ServiceNow ticket worked by hand (Microsoft Learn). Even Account Discovery, the feature that surfaces leftover accounts such as former employees’, requires an app “configured for provisioning” (Microsoft Learn).
A certification that ends in a ticket is a request, not a control.
| What gets reported | What actually matters |
|---|---|
| Users licensed | Apps reached |
| Access certified | Denials executed in the app |
| Apps behind SSO | Apps with automated joiner, mover and leaver |
Fully licensed. Half governed.
Take an illustrative regulated enterprise: 400 apps behind Entra SSO, 6,000 workforce identities, E5 with the ID Governance step-up, and MIM 2016 still running.
| Segment (illustrative) | Apps | Path today | Counts toward reach? |
|---|---|---|---|
| Gallery and SCIM apps | 150 | Entra provisioning | Yes |
| Standard MIM agents (SQL, LDAP, REST) | 50 | MIM | Yes, until MIM goes |
| Custom-coded MIM agents | 20 | MIM custom code | Yes, fragile |
| SSO only | 60 | Entra issues tokens | No: sign-in blocked, account remains |
| Tickets, spreadsheets or nothing | 120 | ServiceNow or email | No |
Licensing coverage is 100%. Reach, the share of apps where joiner, mover and leaver are automated and a review denial is executed in the app, is (150 + 50 + 20) / 400 = 55%, and 70 of those apps depend on MIM. Depth is which lifecycle operations each reached app automates: create, update, disable, delete, groups. The program’s value is reach × depth.
Market data points the same way, on a looser definition: ESG/Omdia research (2025) found that only 54% of available apps were adequately integrated with IGA, so nearly half are not (Dark Reading).
The MIM exit is a 2027 funding decision
MIM 2016 reaches end of extended support on January 9, 2029 (Microsoft Lifecycle). Its portal isn’t standalone: it runs on SharePoint, in most deployments 2016 or 2019 (KuppingerCole), both out of support since July 14, 2026 (SharePoint 2016, SharePoint 2019).
MIM 2016 Service Pack 3 added portal support on SharePoint Subscription Edition in April, and another MIM hotfix shipped on November 5 (Microsoft Learn). Staying is supported but not free: there is no in-place upgrade, so it means a new portal build (Kocho). Microsoft hasn’t published SP2’s end date, but its lifecycle policy supports a previous service pack for “either 12 or 24 months” after a new one ships (Microsoft Lifecycle).
Innofactor, which sells MIM migrations, puts medium and large estates at 12 to 36 months: “Starting in 2026 leaves a working margin; starting in 2028 does not” (Innofactor). On that arithmetic, 2027 is the year a large estate chooses between funding a portal rebuild to stay until 2029 and funding the exit. As KuppingerCole puts it, the extension “changes the deadline, but not the direction” (KuppingerCole).
The exit is mostly a connectivity problem. Microsoft maps most MIM scenarios to Entra equivalents and says “User provisioning is at the very heart of what MIM does” (Microsoft Learn). The management agents, one per connected system, are where the variance lives. I deployed an earlier generation of MIM, Microsoft Identity Integration Server, early in my career. Certificate Management and bastion-forest PAM are the exceptions that need their own hybrid plan (Innofactor).
Microsoft’s path is better than its reputation
The provisioning agent and ECMA Connector Host reach apps that support “SCIM, SQL, LDAP, REST, SOAP, and PowerShell” (Microsoft Learn), and you can import the ECMA2 connectors you already run in MIM (Microsoft Learn). Where an app has a database, directory or documented API and an owner for the connector, that is real, inexpensive coverage. Take it.
It runs out in two places. First, apps with nothing to connect to: if users are managed only through a web admin console, every Microsoft path needs someone to write code. Second, custom code nobody wants to own. Partner gateways and custom ECMA connectors are “built, maintained, and owned by the third-party vendor” (Microsoft Learn), or by you.
Keep, move, retire
Don’t lift and shift. Triage every management agent three ways:
- Keep. A standard SQL, LDAP, web-services or PowerShell agent on a user-only app with a named owner. Export its configuration into the ECMA host (Microsoft Learn).
- Move. Custom code nobody wants to carry to 2029, an app with only a web admin console, or an app where groups or manager references have to be managed, which the on-premises path doesn’t support (Microsoft Learn). Move it to a connectivity layer that presents the app to Entra as a SCIM endpoint.
- Retire. The app is gone, the flow is now native in Entra, or discovery and a baseline review show no live users. Remove the agent and confirm with a review (Microsoft Learn).
The triage matters because a lift-and-shift can lower your coverage. Drop the example’s 20 custom agents and reach falls from 55% to 50%, on the project that was supposed to modernize governance.
Name the layer
The Move bucket is the identity connectivity layer. It sits between Entra and the apps that can’t speak its language, presenting each as a standard SCIM endpoint. Entra keeps the policy and the reviews; the layer reaches the app.
Microsoft’s partner-integrations page lists partner-attested integrations, including Aquera, KloudIdentity, Quorum Systems, Traxion and UNIFY (Microsoft Learn). Outside that list, StackBob is another option. It accepts SCIM operations from an existing IGA platform, Microsoft Entra ID included (StackBob Knowledge Base), and connects that platform to applications regardless of their SCIM or API support (StackBob).
Start with an app-coverage map
The next step needs a spreadsheet and a conversation with each app owner, not a purchase order. For every app in scope, record:
- How it’s connected: gallery or SCIM, ECMA, MIM agent, custom code, SSO only, ticket, nothing.
- Whether joiner, mover and leaver are automated.
- Whether a review denial is executed in the app.
- Who owns the connector.
- Its triage bucket: keep, move or retire.
The share of apps that passes items 2 and 3 is your reach. Fund against that number.
The question coming in 2027
My forecast: by the end of 2027, reach will be the governance number boards and auditors ask for. No regulator mandates it today, but the direction is set. Public companies already have to describe their board’s oversight of cybersecurity risk in the 10-K (SEC). PCAOB staff found that roughly 17% of inspection comment forms in the 2021 and 2022 cycles cited auditors for not sufficiently testing the accuracy and completeness of company-produced information (PCAOB). Access-review evidence is company-produced information, and a review that covers half the estate won’t stay a footnote.
The license buys the review. Reach decides whether the review does anything, and reach is the part no license can buy.
References
- “Microsoft Identity Manager 2016” (lifecycle) — Microsoft Lifecycle — 2022-10-25 — https://learn.microsoft.com/en-us/lifecycle/products/microsoft-identity-manager-2016
- “SharePoint Server 2016” (lifecycle) — Microsoft Lifecycle — 2024-09-27 — https://learn.microsoft.com/en-us/lifecycle/products/sharepoint-server-2016
- “SharePoint Server 2019” (lifecycle) — Microsoft Lifecycle — 2024-09-27 — https://learn.microsoft.com/en-us/lifecycle/products/sharepoint-server-2019
- “Microsoft extends support for Microsoft Identity Manager” — KuppingerCole (Reiner Mertens) — 2026-05-05 — https://www.kuppingercole.com/blog/mertens/microsoft-extends-support-for-microsoft-identity-manager
- “Identity Manager version history” — Microsoft Learn — updated 2026-11-05 — https://learn.microsoft.com/en-us/microsoft-identity-manager/reference/version-history
- “Microsoft Identity Manager SP3: What it means for your identity strategy” — Kocho (Steven Connelly) — 2026-07-10 — https://kocho.co.uk/news/microsoft-identity-manager-sp3-what-it-means-for-your-identity-strategy/
- “Technical Bulletin: Microsoft Identity Manager — status, roadmap, and the path to 9 January 2029” — Innofactor — ~May 2026 — https://lp.innofactor.com/hubfs/Documents/Norway/Technical%20Bulletin-%20%20MIM%20Versions%20And%20Support%20.25%20.pdf
- “Microsoft Entra ID Governance licensing fundamentals” — Microsoft Learn — 2026-07-29 — https://learn.microsoft.com/en-us/entra/id-governance/licensing-fundamentals
- “Microsoft 365 E7 and Agent 365 are now generally available” — Microsoft 365 Blog (Caroline Stanford) — 2026-05-01 — https://techcommunity.microsoft.com/blog/microsoft_365blog/microsoft-365-e7-and-agent-365-are-now-generally-available/4516295
- “Microsoft Entra on-premises application provisioning architecture” — Microsoft Learn — 2026-05-05 — https://learn.microsoft.com/en-us/entra/identity/app-provisioning/on-premises-application-provisioning-architecture
- “Use partner driven integrations to provision accounts into all your applications” — Microsoft Learn (partner entries written by the partners) — 2025-07-24, updated 2026-09-28 — https://learn.microsoft.com/en-us/entra/identity/app-provisioning/partner-driven-integrations
- “Integrate your applications for identity governance and establishing a baseline of reviewed access” — Microsoft Learn — 2024-11-25, updated 2026-04-09 — https://learn.microsoft.com/en-us/entra/id-governance/identity-governance-applications-integrate
- “Govern the existing users of an application that does not support provisioning” — Microsoft Learn — 2026-04-13 — https://learn.microsoft.com/en-us/entra/id-governance/identity-governance-applications-not-provisioned-users
- “Automated ServiceNow Ticket Creation with Microsoft Entra Entitlement Management Integration” — Microsoft Learn — 2026-02-02 — https://learn.microsoft.com/en-us/entra/id-governance/entitlement-management-ticketed-provisioning
- “Migrating to Microsoft Entra ID from Microsoft Identity Manager” — Microsoft Learn — 2025-04-08, updated 2026-10-08 — https://learn.microsoft.com/en-us/microsoft-identity-manager/migrate-entra-id
- “Discover identities in target applications with account discovery” — Microsoft Learn — 2026-08-11, updated 2026-11-03 — https://learn.microsoft.com/en-us/entra/identity/app-provisioning/how-to-account-discovery
- “IGA, App Proliferation, and the App Integration Chasm” (ESG/Omdia research) — Dark Reading (Todd Thiemann, ESG/Omdia) — 2025-11-14 — https://www.darkreading.com/identity-access-management-security/identity-governance-administration-app-proliferation-app-integration-chasm
- “Fixed Lifecycle Policy” — Microsoft Lifecycle — 2022-04-08, updated 2023-02-21 — https://learn.microsoft.com/en-us/lifecycle/policies/fixed
- “Known issues for provisioning in Microsoft Entra ID” — Microsoft Learn — 2026-03-31, updated 2026-07-08 — https://learn.microsoft.com/en-us/entra/identity/app-provisioning/known-issues
- “SEC Adopts Rules on Cybersecurity Risk Management, Strategy, Governance, and Incident Disclosure by Public Companies” (2023-139) — U.S. SEC — 2023-07-26 — https://www.sec.gov/newsroom/press-releases/2023-139
- “Inspection Observations Related to Auditor Use of Data and Reports” (staff Spotlight) — PCAOB staff — April 2024 — https://assets.pcaobus.org/pcaob-dev/docs/default-source/documents/data-and-reports-spotlight.pdf
- “Microsoft Ignite 2026” — Moscone Center — 2026 — https://www.moscone.com/node/852
- StackBob.ai homepage (product claims as stated by StackBob; cited only for applications that “lack SCIM, APIs, or connectors”) — StackBob — accessed 2026-11-06 — https://www.stackbob.ai
- “Supported IGA platforms and capabilities” (product documentation, as stated by StackBob) — StackBob.ai Knowledge Base — 2026-09-22 — https://help.stackbob.ai/en/articles/17061307-supported-iga-platforms-and-capabilities
