Listen to this Post
Introduction:
Microsoft Entra has introduced a pivotal update, allowing organizations to configure whether access package requesters can view their approvers. This granular, tenant-level setting enhances transparency while maintaining security, reshaping identity governance workflows. Although not yet visible in the admin portal, this feature can be configured immediately using PowerShell, offering new control over the access request process.
Learning Objectives:
- Understand the security and operational implications of exposing approver identities to access package requesters.
- Learn how to configure the new `ShowApproverToRequester` setting using Microsoft Graph PowerShell.
- Master the process of updating existing access package assignment policies with the new transparency settings.
You Should Know:
1. Connecting to Microsoft Graph for Entra Management
To manage this feature, you must first establish a secure connection to Microsoft Graph with the appropriate permissions.
Install the Microsoft Graph PowerShell module if not already present Install-Module Microsoft.Graph -Force Connect to Microsoft Graph with required scopes Connect-MgGraph -Scopes "EntitlementManagement.ReadWrite.All" Verify connection context Get-MgContext
This step-by-step process ensures you have the necessary module installed and authenticates your session with Microsoft Graph. The `EntitlementManagement.ReadWrite.All` scope is crucial as it provides the permissions needed to read and write access package configuration. Always verify your connection context to ensure you’re operating with the correct permissions and tenant.
2. Retrieving Existing Access Package Configuration
Before modifying settings, you must identify the specific access packages and policies you need to update.
List all access packages in your tenant $accessPackages = Get-MgEntitlementManagementAccessPackage Display package details in formatted table $accessPackages | Format-Table Id, DisplayName, Description -AutoSize Get specific access package assignment policies $accessPackageId = "your_access_package_id_here" $assignmentPolicies = Get-MgEntitlementManagementAccessPackageAssignmentPolicy -AccessPackageId $accessPackageId
This retrieval process helps you identify the exact resources you need to modify. The commands output all access packages in a formatted table, then let you drill down into the specific assignment policies associated with a particular package. Always verify the IDs before proceeding with configuration changes.
3. Configuring the ShowApproverToRequester Setting
The core configuration involves modifying the assignment policy to control approver visibility.
Import required module for JSON conversion
Import-Module Microsoft.Graph.Authentication
Define parameters for policy update
$params = @{
requestApprovalSettings = @{
isApprovalRequired = $true
isApprovalRequiredForExtension = $false
isRequestorJustificationRequired = $true
approvalMode = "SingleStage"
approvalStages = @(
@{
approvalStageTimeOutInDays = 1
isApproverJustificationRequired = $true
isEscalationEnabled = $false
escalationTimeInMinutes = 0
primaryApprovers = @(
@{
"@odata.type" = "microsoft.graph.groupMembers"
subjectType = "groupMembers"
isBackup = $false
id = "your_approver_group_id_here"
}
)
}
)
showApproverToRequester = $true This is the new setting
}
}
Update the specific assignment policy
Update-MgEntitlementManagementAccessPackageAssignmentPolicy -AccessPackageId $accessPackageId -AccessPackageAssignmentPolicyId $assignmentPolicyId -BodyParameter $params
This comprehensive configuration enables the new visibility feature while maintaining your existing approval workflow. The critical addition is the `showApproverToRequester = $true` parameter that activates the functionality. Ensure all other approval settings align with your organization’s security requirements before applying.
4. Verifying the Configuration Applied Correctly
After making changes, validate that the settings have been properly applied.
Retrieve the updated policy to verify changes $updatedPolicy = Get-MgEntitlementManagementAccessPackageAssignmentPolicy -AccessPackageId $accessPackageId -AccessPackageAssignmentPolicyId $assignmentPolicyId Display the request approval settings $updatedPolicy.RequestApprovalSettings | Format-List Export configuration for audit purposes $updatedPolicy | ConvertTo-Json -Depth 10 | Out-File -FilePath "AccessPackagePolicy_Backup.json"
Verification is crucial to ensure the configuration applied correctly. The commands retrieve the updated policy and display the approval settings in detail, allowing you to confirm the `ShowApproverToRequester` value is set as intended. The export function creates an audit trail for compliance purposes.
5. Bulk Configuration Across Multiple Access Packages
For organizations with numerous access packages, automated bulk configuration is essential.
Script to update all access package policies in tenant
$allAccessPackages = Get-MgEntitlementManagementAccessPackage
foreach ($package in $allAccessPackages) {
$policies = Get-MgEntitlementManagementAccessPackageAssignmentPolicy -AccessPackageId $package.Id
foreach ($policy in $policies) {
Check if policy requires approval (only these need the setting)
if ($policy.RequestApprovalSettings.IsApprovalRequired -eq $true) {
$params = @{
requestApprovalSettings = @{
showApproverToRequester = $true
Preserve all existing settings
isApprovalRequired = $policy.RequestApprovalSettings.IsApprovalRequired
isApprovalRequiredForExtension = $policy.RequestApprovalSettings.IsApprovalRequiredForExtension
approvalMode = $policy.RequestApprovalSettings.ApprovalMode
Include all other existing properties...
}
}
Update policy with new setting while preserving others
Update-MgEntitlementManagementAccessPackageAssignmentPolicy -AccessPackageId $package.Id -AccessPackageAssignmentPolicyId $policy.Id -BodyParameter $params
}
}
}
This bulk operation script iterates through all access packages in your tenant and enables the approver visibility feature only for policies that require approval. The script carefully preserves all existing settings while adding the new parameter, preventing unintended configuration changes.
6. Security Hardening: Limiting Visibility for Sensitive Packages
For highly sensitive access packages, you might want to disable this feature specifically.
Identify sensitive access packages by naming pattern or classification
$sensitivePackages = $allAccessPackages | Where-Object {$_.DisplayName -match "Sensitive|Executive|Admin"}
foreach ($package in $sensitivePackages) {
$policies = Get-MgEntitlementManagementAccessPackageAssignmentPolicy -AccessPackageId $package.Id
foreach ($policy in $policies) {
$params = @{
requestApprovalSettings = @{
showApproverToRequester = $false Explicitly disable for sensitive packages
Preserve all other existing settings
isApprovalRequired = $policy.RequestApprovalSettings.IsApprovalRequired
isApprovalRequiredForExtension = $policy.RequestApprovalSettings.IsApprovalRequiredForExtension
approvalMode = $policy.RequestApprovalSettings.ApprovalMode
}
}
Update-MgEntitlementManagementAccessPackageAssignmentPolicy -AccessPackageId $package.Id -AccessPackageAssignmentPolicyId $policy.Id -BodyParameter $params
}
}
This security-focused configuration ensures that for sensitive access packages (identified by naming patterns), the approver visibility remains disabled. This layered approach allows organizations to balance transparency with security where truly needed.
7. Monitoring and Audit Configuration
Implement comprehensive monitoring to track when requesters view approver information.
Configure audit log retention policies to capture access package events
Set-MgPolicyAuditConfig -IsEnabled $true -RetentionDays 365
Retrieve access package related audit logs
$startDate = (Get-Date).AddDays(-7)
$auditLogs = Get-MgAuditLogDirectoryAudit -Filter "activityDisplayName eq 'Update assignment policy'" -Top 100
Export audit logs for compliance reporting
$auditLogs | Export-Csv -Path "AccessPackagePolicyChanges_$(Get-Date -Format 'yyyyMMdd').csv" -NoTypeInformation
Set up alert for policy changes
$alertParams = @{
displayName = "Access Package Policy Modification Alert"
severity = "medium"
enabled = $true
description = "Triggers when any access package assignment policy is modified"
Additional alert configuration...
}
New-MgIdentityProtectionAlertPolicy -BodyParameter $alertParams
These monitoring commands ensure you have visibility into policy changes and can track how the new feature is being utilized. The audit log configuration retains records for compliance purposes, while the alerting setup provides real-time notification of policy modifications.
What Undercode Say:
- Granular transparency control represents a significant shift toward user-centric identity governance without compromising security.
- PowerShell administration continues to provide advanced configuration capabilities before features reach the GUI, emphasizing the value of automation skills.
This update reflects Microsoft’s continued commitment to balancing security with usability in identity management. The ability to configure approver visibility at the tenant level provides organizations with flexibility—they can enhance transparency for routine access requests while maintaining privacy for sensitive approvals. The PowerShell-first rollout strategy reinforces that Entra remains an enterprise-grade platform where automation and precise control are paramount. Organizations should carefully consider their use cases before implementing this broadly, as exposing approver information could potentially lead to social engineering attempts in high-security environments.
Prediction:
This feature will fundamentally shift access request dynamics across enterprises, potentially reducing approval cycle times by increasing accountability. However, we anticipate sophisticated social engineering attacks targeting exposed approver identities, necessitating advanced security training. Within 18-24 months, expect AI-driven predictive approval routing to emerge, automatically masking sensitive approver identities based on content analysis and risk scoring.
🎯Let’s Practice For Free:
IT/Security Reporter URL:
Reported By: Danielbradley2 Microsoft – Hackers Feeds
Extra Hub: Undercode MoN
Basic Verification: Pass ✅
