MT.1107: Access packages and catalogs should not reference deleted groups.

ID	MT.1107
Severity	Low
Suite	Mito
Product	Entra ID
Feature	Identity Governance
Security area	Identity lifecycle and hygiene
Resource type	AccessPackage
User impact of fixing	Low
Effort to fix	Medium
Reads from	Microsoft Graph
Licence needed	AAD_PREMIUM_P2, Entra_Identity_Governance

What this checks and how to fix it

This test identifies Microsoft Entra ID Governance access packages and catalogs that contain references to deleted Entra ID groups. Deleted group references can cause access provisioning failures, broken approval workflows, and compliance violations.

The test validates:

• Groups assigned as resources in access packages still exist
• Groups configured as approvers in assignment policies are active
• Groups registered in catalogs have not been deleted

For any deleted groups found, the test attempts to retrieve the group name from the recycle bin (directory/deletedItems) to help identify which groups need attention.

Remediation action

Option 1: Remove Deleted Group References

1. Navigate to Entra Admin Center → Identity Governance → Access Packages
2. For each affected access package:
   • Go to Resources and remove the deleted group
   • Update assignment policies to remove deleted group approvers
3. For affected catalogs:
   • Select the catalog → Resources
   • Remove the deleted group

Option 2: Restore Deleted Groups

1. Navigate to Entra Admin Center → Identity → Groups → Deleted groups
2. Select the deleted group(s) and click Restore group
3. Re-run the test to confirm resolution

Option 3: Replace with Active Groups

1. Create or identify replacement active groups
2. Add new groups to access packages/catalogs
3. Update assignment policies with new approver groups
4. Remove deleted group references

Related links

• Microsoft Entra ID Governance Documentation
• Access Packages Overview
• Manage Resources in Access Packages
• Access Package Catalogs
• Microsoft Graph API - Entitlement Management

---

Mito check. Author: nicowyss; contributors: JeanPhilippeGeorge. Open-source licences.