Microsoft Entra ID Governance and apps without provisioning: the documented path, step by step

Microsoft deserves credit for documenting this at all. Many vendors describe what their connectors do and say nothing about the applications without one. Microsoft's Learn article on governing users of applications that do not support provisioning is a working procedure.

What are the steps?

As Microsoft documents them:

1. Export the application's current users to a CSV file from the application itself.
2. Match those users to Entra ID users.
3. Create role assignments in Entra for the matched users, so Entra knows who should have the application.
4. Run an access review in Entra ID Governance on those assignments.
5. When a reviewer denies access, the user loses the app role assignment in Entra. Because Entra cannot change the application, removal in the application is manual, and Microsoft describes optionally creating a ServiceNow ticket for it.

What does it give you?

A record. Each step leaves evidence in Entra: who was assigned, who reviewed, what was decided. For an auditor, that is far better than a spreadsheet signed by email. Microsoft also documents account discovery, which shows users in an application who do not match any Entra ID user, and its what's new page lists Account Discovery as generally available in April 2026.

What does it ask of your team?

• Someone has to produce a clean export from each application, every cycle.
• Matching is only as good as the identifiers the application stores; accounts with no email or employee number need a person to decide.
• Local, service and break-glass accounts do not match any Entra user and need a separate decision.
• The removal at the end is a ticket, so the time between a denial and the actual removal depends on whoever works the queue.

When is the manual path enough?

For a small number of low-change applications, a documented manual path may be all you need. For dozens of applications, or for applications with frequent joiners and leavers, the effort multiplies. That is the point at which connectors (Microsoft lists SCIM 2.0, LDAP, SQL, REST, SOAP, PowerShell and ECMA connectors, including on-prem provisioning without opening firewalls) or a tool that reaches into the application become worth pricing.

What does it cost?

Microsoft publishes Entra ID Governance at $7.00 per user per month, paid yearly, on top of Entra ID P1 ($7.00) or P2 ($10.00). It is the only published per-user price among the tools scored on this site (Orchid Security lists a single package on AWS Marketplace), and the coverage gap calculator multiplies it out for your user count. The labor of the manual path is not on any price list, so estimate it per application before deciding.

Sources