MT.1109: Access package approval workflows must have valid approvers.

ID	MT.1109
Severity	Low
Suite	Mito
Product	Entra ID
Feature	Identity Governance
Security area	Identity lifecycle and hygiene
Resource type	AccessPackage
User impact of fixing	Low
Effort to fix	Medium
Reads from	Microsoft Graph
Licence needed	AAD_PREMIUM_P2, Entra_Identity_Governance

What this checks and how to fix it

This test identifies Microsoft Entra ID Governance access package assignment policies with approval workflows that reference invalid approvers. Invalid approvers cause approval workflow failures, access request timeouts, and create significant operational overhead.

The test validates:

• User approvers exist in the directory and accounts are enabled
• Group approvers exist and have at least one member
• Policies requiring approval have approval stages with primary approvers configured
• Approval workflows are complete and functional

Note: Manager approvers are noted but not validated (resolved at request time).

Remediation action

For Deleted User Approvers:

1. Navigate to Entra Admin Center → Identity Governance → Access Packages
2. Select the affected access package → Policies tab
3. Edit the affected policy → Approval settings
4. Remove deleted users and add valid replacement approvers
5. Consider using groups for resilience
6. Test the approval workflow

For Disabled User Approvers:

1. Determine if user should be re-enabled or replaced
2. If temporary: Re-enable the user account in Entra ID
3. If permanent: Replace with active user or group
4. Update policy Approval settings

For Deleted or Missing Groups:

1. Edit the policy → Approval settings
2. Remove references to deleted groups
3. Create or select a valid approval group with active members
4. Update the policy and save

For Empty Approval Groups:

1. Navigate to Entra ID → Groups
2. Find the approval group and add appropriate members
3. Ensure multiple members for redundancy
4. Verify the access package policy

For Missing Approval Stages or Primary Approvers:

1. Edit the policy → Approval settings
2. Add at least one approval stage
3. Configure primary approvers (users, groups, or manager)
4. Set timeout values and save

Related links

• Microsoft Entra ID Governance Documentation
• Configure Access Package Approval
• Approval Workflow Settings
• Microsoft Graph API - Approval Settings

---

Mito check. Author: nicowyss; contributors: JeanPhilippeGeorge. Open-source licences.