TOOL PROFILE · GOVERNANCE ADD-ON TO AN IDENTITY PROVIDER

Microsoft Entra ID Governance review 2026: reach beyond Entra-connected apps

The short answer

Microsoft Entra ID Governance ranks 5 (tied) of 8 at 6.15 out of 10. It is the only tool here with a published per-user price ($7.00 per user per month on top of Entra ID P1 or P2), documents connectors for on-prem and custom apps, and has generally available agent identities. For apps without provisioning Microsoft documents a CSV export, a review and a manual removal or ticket, and discovery of apps outside Entra is not described.

By The Credential Desk · IAM Compared · Published 2026-10-08

Desk research from public vendor pages and documentation read in September 2026, updated 2026-10-13. Editorial assessment; we did not test the products.

Rank 5 (tied) of 8 on default weights

Published per-user price and documented on-prem connectors

Change the weights in the coverage gap calculator

What shape is Entra ID Governance's reach?

DISC: Unmanaged app discovery; 3.5
INAPP: Accounts inside the app; 5.5
NOAPI: Reach into apps without APIs or SCIM; 6.5
ORCH: Orchestrates through the existing stack; 5.0
EXEC: Executes changes itself; 8.0
NHI: Machine, service and agent accounts; 8.0
EVID: Audit evidence; 7.0
PRICE: Pricing transparency; 9.5

Each sector is one criterion. The longer the engraved sector, the higher the editorial score. Sectors are equal width, so the picture shows the shape of a tool's reach, not its weighted total.

What does Entra ID Governance do?

Microsoft's governance add-on for lifecycle workflows, access reviews and entitlement management, with provisioning connectors for on-prem and custom apps.

Governance features: Lifecycle workflows (before start, at status change, at departure), access reviews, entitlement management.; Source: Microsoft Learn: Entra ID Governance overview · Read 27 Sep 2026
Provisioning connectors: SCIM 2.0, LDAP, SQL, REST, SOAP, PowerShell and ECMA connectors; on-prem provisioning without opening firewalls.; Source: Microsoft Learn: app provisioning · Read 27 Sep 2026
Apps without provisioning: Export users to CSV, match them to Entra users, create role assignments, run an access review, optionally open a ServiceNow ticket for manual removal.; Source: Microsoft Learn: governing users of apps that don't support provisioning · Read 27 Sep 2026
Account discovery: Shows users in an application that do not match an Entra ID user.; Source: Microsoft Learn: governing an application's existing users · Read 27 Sep 2026
Release note: Microsoft's what's new page lists Account Discovery as generally available in April 2026.; Source: Microsoft Learn: What's new in Microsoft Entra · Read 27 Sep 2026
HR sources: Workday, SAP SuccessFactors, SAP HCM and API-driven inbound provisioning.; Source: Microsoft Learn: HR-driven provisioning · Read 27 Sep 2026
Agent ID: Generally available for all Entra customers: agent identities, blueprints, sponsors, Conditional Access and ID Protection for agents; extended features need Microsoft Agent 365.; Source: Microsoft Learn: Entra Agent ID for AI agents · Read 27 Sep 2026
Privileged Identity Management: Valid licences for PIM are Microsoft Entra ID Governance or Microsoft Entra ID P2.; Source: Microsoft Learn: ID Governance licensing fundamentals · Read 11 Oct 2026

What does Entra ID Governance state about itself?

We did not collect a headline figure or finding from Microsoft Entra ID Governance for this page.

Which parts of the estate does Entra ID Governance document?

Unsanctioned SaaSNot documented
Discovery of apps outside Entra not described in the governance docs reviewed
On-prem and legacy appsDocumented
ECMA connector host, LDAP and SQL for on-prem apps
Source: Microsoft Learn: app provisioning · Read 27 Sep 2026
Custom-built appsPartial
REST, SOAP and PowerShell connectors; CSV path otherwise
Source: Microsoft Learn: app provisioning · Read 27 Sep 2026
Local accounts in appsPartial
Account discovery shows app users not matched to Entra users
Source: Microsoft Learn: governing an application's existing users · Read 27 Sep 2026
Service accounts and hardcoded credentialsPartial
Workload identities priced and governed in Entra; hardcoded credentials in apps not described
Source: Microsoft Entra pricing · Read 27 Sep 2026
AI agentsDocumented
Entra Agent ID generally available
Source: Microsoft Learn: Entra Agent ID for AI agents · Read 27 Sep 2026

How does Entra ID Governance score on each criterion?

Criterion scores for Microsoft Entra ID Governance, with badges computed against all 8 tools.
Criterion	Weight	Score	Why	Source
Unmanaged app discovery	18%	3.5 / 10	Account discovery covers users inside connected apps; discovery of apps outside Entra is not described in the governance docs reviewed.	Source: Microsoft Learn: governing an application's existing users · Read 27 Sep 2026 · Source: Microsoft Learn: What's new in Microsoft Entra · Read 27 Sep 2026
Accounts inside the app	16%	5.5 / 10	Account discovery shows app users that match no Entra ID user; apps without provisioning rely on a CSV export.	Source: Microsoft Learn: governing an application's existing users · Read 27 Sep 2026 · Source: Microsoft Learn: governing users of apps that don't support provisioning · Read 27 Sep 2026
Reach into apps without APIs or SCIM	14%	6.5 / 10	SCIM, LDAP, SQL, REST, SOAP, PowerShell and ECMA connectors, including on-prem apps; a manual CSV path for the rest.	Source: Microsoft Learn: app provisioning · Read 27 Sep 2026 · Source: Microsoft Learn: governing users of apps that don't support provisioning · Read 27 Sep 2026
Orchestrates through the existing stack	14%	5.0 / 10 Lowest in set	Requires Entra ID P1 or P2 and fits best when Entra is the identity provider; manual removals can be routed to ServiceNow tickets.	Source: Microsoft Entra pricing · Read 27 Sep 2026 · Source: Microsoft Learn: governing users of apps that don't support provisioning · Read 27 Sep 2026
Executes changes itself	12%	8.0 / 10	Lifecycle workflows before start, at status change and at departure, plus HR-driven provisioning.	Source: Microsoft Learn: Entra ID Governance overview · Read 27 Sep 2026 · Source: Microsoft Learn: HR-driven provisioning · Read 27 Sep 2026
Machine, service and agent accounts	10%	8.0 / 10 Tied highest	Entra Agent ID is generally available, and workload identities are priced and governed in Entra.	Source: Microsoft Learn: Entra Agent ID for AI agents · Read 27 Sep 2026 · Source: Microsoft Entra pricing · Read 27 Sep 2026
Audit evidence	10%	7.0 / 10	Review decisions and assignments are recorded in Entra; no framework-mapped evidence pack described.	Source: Microsoft Learn: Entra ID Governance overview · Read 27 Sep 2026
Pricing transparency	6%	9.5 / 10 Highest in set	$7.00 per user per month, paid yearly, published, on top of Entra ID P1 or P2.	Source: Microsoft Entra pricing · Read 27 Sep 2026

Where does Entra ID Governance lead, and where does it trail?

Leads or ties the set on

Machine, service and agent accounts
Pricing transparency

Trails the leader on

Unmanaged app discovery: 3.5 against Orchid at 9.5
Orchestrates through the existing stack: 5.0 against Orchid at 9.5
Accounts inside the app: 5.5 against Orchid at 9.0
Reach into apps without APIs or SCIM: 6.5 against Orchid at 9.0

Strengths on its public pages

The only tool here with a published per-user price.
Documented connectors for on-prem and custom apps, and generally available agent identities.

Limits on its public pages

Requires Entra ID P1 or P2 and fits best where Entra is the identity provider.
For apps without provisioning, the documented path is a CSV export, a review and a manual removal or ticket.

What does Entra ID Governance cost, and how is it deployed?

Pricing

$7.00 per user per month, paid yearly. Requires Microsoft Entra ID P1 ($7.00) or P2 ($10.00). Microsoft Entra Suite $12.00 per user per month. Workload ID $3.00 per workload identity per month.

Source: Microsoft Entra pricing · Read 27 Sep 2026

Deployment

Microsoft cloud service, with an on-prem connector host for provisioning.

Who is Entra ID Governance for?

Microsoft-centric estates that want to model cost up front and reach on-prem apps through connectors.

Consider instead if finding applications nobody connected is the first problem: Orchid Security.

How does Entra ID Governance compare with each other tool?

Entra ID Governance vs Orchid
Orchid Security scores higher overall, 8.24 against 6.15
Entra ID Governance vs Veza
Veza scores higher overall, 6.37 against 6.15
Entra ID Governance vs Saviynt
Tied at 6.15
Entra ID Governance vs SailPoint
SailPoint Identity Security Cloud scores higher overall, 6.21 against 6.15
Entra ID Governance vs C1
C1 (formerly ConductorOne) scores higher overall, 6.30 against 6.15
Entra ID Governance vs Lumos
Microsoft Entra ID Governance scores higher overall, 6.15 against 6.13
Entra ID Governance vs Apono
Microsoft Entra ID Governance scores higher overall, 6.15 against 4.78

Moving off Entra ID Governance? See the alternatives Visit Microsoft

Learn more

LESSON 07
How identity tools reach applications without APIs or SCIM
Seven ways to get account data in and out of a hard application.
LESSON 03
Shadow authentication paths: sign-ins that bypass single sign-on
Why an app on single sign-on can still be entered another way.

Frequently asked questions

What is Microsoft Entra ID Governance?

Microsoft's governance add-on for lifecycle workflows, access reviews and entitlement management, with provisioning connectors for on-prem and custom apps. It sits in the governance add-on to an identity provider layer.

How does Microsoft Entra ID Governance score on reach beyond the IdP?

6.15 out of 10, rank 5 (tied) of 8 on default weights. Its highest criterion scores are Pricing transparency (9.5) and Executes changes itself (8.0) and its lowest is Unmanaged app discovery (3.5).

What are the alternatives to Microsoft Entra ID Governance?

On our reach score the closest alternatives are Orchid Security, Veza and C1 (formerly ConductorOne). The moving-off page lists every alternative and the criteria where each scores higher.

Moving off Entra ID Governance