🔹 Feature: Microsoft Entra Tenant Governance
🔹 What It Does: Tenant as Code, Drift Detection, Multi-Tenant Admin.
What Is It Giving You:
✅ Tenant As Code (Configuration Baselines): Author a JSON baseline that expresses the desired state of tenant resources — your “tenant blueprint.” 200+ resource types supported across six services: Entra, Intune, Exchange Online, Teams, Purview, and Defender. Source-control it, peer-review it, version it.
✅ Snapshot a Known-Good Tenant: Take a configuration snapshot of an existing “golden” tenant to jumpstart your baseline authoring. Snapshots also satisfy audit requirements as point-in-time evidence.
✅ Continuous Drift Detection: Configuration monitors run every 6 hours and compare each tenant’s actual state to your JSON baseline. View aggregated drift across all monitors or drill into individual properties that diverged from the desired state.
✅ Multi-Tenant Administration via Governance Relationships: Set up cross-tenant administrative access between your governing tenant and the tenants you need to govern — using invitation/request/approval workflows. Least-privilege cross-tenant admin (configuration management included) — no more bouncing through guest accounts or shared admin creds.
✅ Streamlined App Injection: Provision and maintain permissions for your custom apps across multiple governed tenants in one workflow. Reusable governance policy templates mean you ask for the same permissions in many tenants without re-authoring each time.
✅ Find the Tenants You Didn’t Know You Had: The Related Tenants feature auto-discovers tenants connected to you via three signals — B2B access (inbound/outbound), multitenant application permissions, and shared commerce billing. Shadow IT, finally visible.
✅ Secure Tenant Creation: Control which users can create new add-on tenants (via commerce billing access). Auto-establish a governance relationship with new tenants as they’re created. Recover admin access to an add-on tenant when the last admin leaves — or a threat actor compromises it — via the Microsoft Entra commerce asset.
📋 Worth knowing:
🔸 Requires Microsoft Entra ID Governance or Entra Suite licenses; two service levels (Basic and Premium).
🌐 https://learn.microsoft.com/en-us/entra/id-governance/tenant-governance/overview
