Where Microsoft Entra ID ends and identity governance begins
This is not a Microsoft Entra licensing plan comparison. It explains the role of a standalone identity governance layer.
Why more organizations are solving Microsoft Entra integration with IdStory
Hybrid identity governance is today’s core problem for enterprises. In the Microsoft ecosystem, the path runs through Entra ID, whether as an extension of on-premises Active Directory or as a cloud-native solution for Microsoft 365 users. As identities multiply and authenticate against Entra, the question becomes: who actually manages them?
Microsoft Entra and Identity Governance
The “Microsoft cloud world” in identity context means the service ecosystem authenticating against Entra ID. This includes Microsoft 365 (Teams, SharePoint, OneDrive, Exchange Online), Power Platform, Dynamics 365, and hundreds of third parties using Entra ID as identity provider. Outside this world remain most on-premises systems, ERPs like SAP, manufacturing and vertical applications, and local SaaS without Entra integration.
In many organizations, a gap exists between HR records and IT system reality. HR shows one headcount; Entra ID typically contains significantly more active identities. In our customer base, difference analysis often reveals active Entra identities exceeding actual employee count by tens of percent. The difference comprises forgotten contractor accounts, former colleagues, service accounts, and guests invited to MS Teams with no formal offboarding process.
Today’s breaches rarely start at the firewall. They start with a compromised identity. An attacker doesn’t need to break through perimeter security; they need only sign in with a stolen or forgotten account. Gartner’s IAM predictions reflect this: identity is the new security perimeter. Orphaned accounts aren’t an operational detail. They’re a measurable business risk.
Roles that cannot be substituted: lock vs. reception desk
Microsoft Entra ID is world-class authentication infrastructure. It answers: “Can this user sign in and access this resource?” It is a perfect lock, validating keys, passwords, MFA, biometrics.
IdStory answers a different question: “Who should exist in this system and based on what event?” It decides who gets the key, when it’s revoked, and why. It reads data from HR as source of truth and propagates changes to Entra ID, on-premises Active Directory, and other target systems within a single auditable process.
| Layer | Answers the question |
|---|---|
| Microsoft Entra ID | “Can this user sign in and access this resource?” — a lock validating keys, passwords, MFA, biometrics. |
| IdStory | “Who should exist in this system and based on what event?” — decides who gets the key, when it is revoked, and why. |
Entra is infrastructure. IdStory is governance. While Microsoft provides a global template, IdStory adapts to your organization’s reality: connecting to your HR system as source of truth and enforcing approval workflows matching your business rules. Without a governance layer, you have an excellent vault but no receptionist controlling who gets building keys.
Three scenarios where process protects your integrity
1. Onboarding: productivity from hour one
In typical IT setups, administrators manually create accounts in on-premises AD, wait for sync, then manually assign M365 licenses. The whole process takes days. IdStory reads HR data and uses Microsoft Graph API to provision identities, assign licenses, and add users to the correct Teams groups. Users are productive immediately. IT eliminates mechanical work.
2. External identities and machine accounts: ending the gray zone
Anyone in MS Teams can invite guests, a long-standing frustration for security teams. Add rising machine identity proliferation: service accounts, API keys, technical integrations, and now AI agents with access to company data without clear ownership.
IdStory ties every identity, human or machine, to a specific owner and expiration date. When a role or contract ends, access revokes automatically. Manual recertification via email and shared spreadsheets becomes unsustainable once provisioned identities exceed a few hundred.
3. Audit: demonstrable due diligence
An auditor asks: who approved access to sensitive data a year ago? In an environment of emails and tickets, retrieval is nearly impossible. IdStory maintains an audit trail for every identity change from creation to deprovisioning, usable for ISO 27001 and regulatory audits under emerging cybersecurity regulations.
Real impact on IT operations
Deploying IdStory as a governance layer above Entra transforms IT teams’ daily reality in three ways.
Reduced helpdesk load. MFA resets or access restoration can be safely delegated to first-line operators via API, without granting powerful admin rights in Entra ID.
End to license waste. M365, Salesforce, and other SaaS licenses free up when someone leaves or changes role. For organizations with hundreds of users, annual savings add up.
Consistency across ecosystems. IdStory maintains identity state in Microsoft environments and beyond: in ERPs, manufacturing systems, and applications with no Entra connection.
Integration through Microsoft Graph API
IdStory communicates with the cloud via the modern Microsoft Graph API. It is vendor-supported and the modern way to make granular cloud changes without maintaining risky on-premises scripts. This allows, for example, safe MFA reset delegation at the helpdesk.
Without this layer, you have tools but no control.
Management accountability and risk governance
Cybersecurity moved onto the agenda of statutory bodies. If a company cannot demonstrate who has access to sensitive data and why, management faces liability. IdStory serves as key evidence of due diligence, confirming to auditors the existence of controlled, auditable processes.
When IdStory doesn’t make sense
Not every organization needs IdStory. Plainly:
- Small organizations under ~300 users in purely cloud environments with a single HR system. Native Microsoft tools usually suffice; alternatively, purchase Entra ID Governance.
- Organizations without hybrid environments and no systems outside the Microsoft ecosystem. If the entire stack is M365 plus a few cloud SaaS with good Entra connectors, the added value of a standalone identity management layer diminishes.
- Organizations without formalized HR processes. IdStory is only as good as its source of truth. If HR data isn’t current, no IdM fixes that; it only automates the broken state.
IdStory delivers real value in hybrid environments, organizations with multiple HR systems, significant contractor populations, or regulated industries where audit trails are mandatory, not optional.
Decision framework
If you’re evaluating whether you need an identity governance layer, ask four questions:
- Do we have one authoritative source of truth about who is currently an employee, and do all changes propagate across systems within an hour?
- Can we demonstrate without manual investigation who approved access to sensitive data a year ago?
- How many licenses are we paying for identities that no longer exist in the organization?
- Do we manage identity lifecycle in ERP, manufacturing systems, and on-premises applications outside the Microsoft world?
If the answers are “not fully,” this is a problem to solve regardless of your Entra license level.
Conclusion: gain control before identity becomes risk
Identity governance isn’t about account cleanup. It’s about keeping system state aligned with organizational reality continuously, not just on audit day. In an environment where cybersecurity accountability shifts to leadership, an auditable identity lifecycle is a basic business requirement, not a luxury.
In most organizations, the count of orphaned accounts in Entra ID is surprisingly high and represents both security and financial risk. The first step to remediation is a difference analysis between your HR records and other systems.
Sources
- Microsoft Entra documentation: https://learn.microsoft.com/en-us/entra/
- Gartner: Top Cybersecurity Trends: https://www.gartner.com/en/newsroom
- NIST Cybersecurity Framework: https://www.nist.gov/cyberframework
Facing a similar challenge? Contact us at sales@idstory.com
