Access Packages

Access packages, part of Microsoft Entra ID Governance, bundle the groups and roles a person needs into one item they can request. Each request goes through approval, and access expires automatically, so no one holds access they no longer need.

• Access Packages 101: How the System Works: the building blocks (PAGs, catalogs, access packages, PIM policies), the two-stage JIT flow, why the code is split across Lane A and Lane B, and why catalog_onboarding exists.
• Manage Access Packages: step-by-step runbook for defining and creating a new access package and persona group.
• Multi-Tenant Access Packages (Home & Guest Tenants): how MyAccess, Access Packages, and PIM work across a Home Tenant (Tenant A) and a B2B Guest Resource Tenant (Tenant B).
• Azure Lighthouse vs. B2B Guest Access Packages: how Azure Lighthouse simplifies subscription-level access from Tenant A, and where you still need B2B Guests in Tenant B.

Related:

• Role Tier Mapping: which roles are Tier 0 and need stricter controls than a package alone gives.
• Microsoft Entra ID Governance: access packages