Merge pull request #245879 from OWinfreyATL/owinfreyATL-UsersLifecycleChanges

User Lifecycle Updates

Author: denrea

articles/active-directory/governance/entitlement-management-access-package-assignments.md

@@ -11,7 +11,7 @@ ms.workload: identity
 ms.tgt_pltfrm: na
 ms.topic: how-to
 ms.subservice: compliance
-ms.date: 05/31/2023
+ms.date: 06/27/2023
 ms.author: owinfrey
 ms.reviewer: 
 ms.collection: M365-identity-device-management
@@ -22,15 +22,16 @@ ms.collection: M365-identity-device-management
 ---
 # View, add, and remove assignments for an access package in entitlement management
 
-In entitlement management, you can see who has been assigned to access packages, their policy, and status. If an access package has an appropriate policy, you can also directly assign user to an access package. This article describes how to view, add, and remove assignments for access packages.
+In entitlement management, you can see who has been assigned to access packages, their policy, status, and user lifecycle (preview). If an access package has an appropriate policy, you can also directly assign user to an access package. This article describes how to view, add, and remove assignments for access packages.
 
 ## Prerequisites
 
 To use entitlement management and assign users to access packages, you must have one of the following licenses:
 
 
-- Microsoft Azure AD Premium P2 or Microsoft Entra ID Governance
+- Azure AD Premium P2
 - Enterprise Mobility + Security (EMS) E5 license
+- Microsoft Entra ID governance subscription
 
 ## View who has an assignment
 
@@ -188,6 +189,37 @@ $policy = $accesspackage.AssignmentPolicies[0]
 $req = New-MgEntitlementManagementAccessPackageAssignmentRequest -AccessPackageId $accesspackage.Id -AssignmentPolicyId $policy.Id -TargetEmail "[email protected]"
 ```
 
+## Manage user lifecycle (preview)  
+
+Entitlement management also allows you to get visibility into state of a guest user's lifecycle through the following viewpoints: 
+
+- **Governed** - The user is set to be governed.  
+- **Ungoverned** - The user is set to not be governed.
+- **Blank** - The lifecycle for the user is not determined. This happens when a user had an access package assigned before managing user lifecycle was possible.
+
+> [!NOTE]
+> When a guest user is set as **Governed**, based on ELM tenant settings their account will be deleted or disabled in specified days after their last access package assignment expires.  Learn more about ELM settings here: [Manage external access with Azure Active Directory entitlement management](../fundamentals/6-secure-access-entitlement-managment.md).
+
+You can directly convert ungoverned users to governed by using the **Mark Guests as Governed ( preview)** functionality in the top menu bar. 
+
+To manage user lifecycle, you'd follow these steps:
+
+**Prerequisite role:** Global administrator, User administrator, Catalog owner, Access package manager or Access package assignment manager
+
+1. In the Azure portal, select **Azure Active Directory** and then select **Identity Governance**.
+
+1. In the left menu, select **Access packages** and then open the access package.
+
+1. In the left menu, select **Assignments**.
+
+1. On the assignments screen, select the user you want to manage the lifecycle for, and then select **Mark guest as governed (Preview)**.
+    :::image type="content" source="media/entitlement-management-access-package-assignments/govern-user-lifecycle.png" alt-text="Screenshot of the govern user lifecycle selection.":::
+1. Select save.
+
+## Manage user lifecycle programmatically 
+
+To manage user lifecycle programatically using Microsoft Graph, see: [accessPackageSubject resource type](/graph/api/resources/accesspackagesubject).
+
 ## Remove an assignment
 
 You can remove an assignment that a user or an administrator had previously requested.
@@ -227,4 +259,4 @@ $req = New-MgEntitlementManagementAccessPackageAssignmentRequest -AccessPackageA
 ## Next steps
 
 - [Change request and settings for an access package](entitlement-management-access-package-request-policy.md)
-- [View reports and logs](entitlement-management-reports.md)
+- [View reports and logs](entitlement-management-reports.md)