Skip to content

Identity and access

Admins, service accounts and app registrations with power over Power Platform, under control.

21checks

In short

Identity and access is one of the 11 core modules in The Governor, Ustrema's governance app for Microsoft Power Platform, Copilot Studio and agents. It runs 21 checks every week to answer one question: Who can change production, and would we notice? Every failing check becomes a finding with an owner, closed with Microsoft Entra ID, Privileged Identity Management, Conditional Access.

The question it answers

Who can change production, and would we notice?

What it measures

Each of the 21 checks looks for patterns like these, in every environment, every week:

  • Admin roles held permanently instead of through PIM
  • Production flows owned by personal accounts
  • App registrations with old secrets
  • Connections owned by people who have left

What you get

Once the findings are closed and the controls are in place, your tenant has:

  • Service accounts and principals for production
  • Admin access through PIM
  • Secrets rotated or removed

Microsoft services it works with

The Governor checks that these Microsoft controls are on, and our experts configure them:

  • Microsoft Entra ID
  • Privileged Identity Management
  • Conditional Access
The service that closes these findingsPlatform rollout and Managed Environments

Questions about this module

Is Identity and access included in the platform licence?

Yes. All 11 core modules, Identity and access included, come with one platform licence per tenant per year. There are no per-user fees. Extension modules are added separately.

How often does The Governor check identity and access?

Every week. The scan runs inside your own tenant, measures all 21 checks again and shows what closed, what is still open and what came back since the last scan.

Which Microsoft services does it work with?

Microsoft Entra ID, Privileged Identity Management, Conditional Access. The Governor checks that they are switched on and configured, and Ustrema consultants set them up when they are not.

Sources

The primary documentation and law this page relies on. Each link opens the original source.