Hundreds of groups in Entra ID.
Do you even know what they're for?
Identity Manager gives IT and security administrators a central overview of groups, access and their classification — delegated, inside your Microsoft 365. No PowerShell scripts, no expensive IGA tool.
Three pains every IT and security administrator knows.
Groups with no owner
After years of growth, half the groups in Entra ID have an empty owner field. With no one accountable for the contents, membership balloons and no one reviews it.
No one knows what a group is for
“HR-2019”, “Project-Alfa”, “Test-Marek” — names all over the place. No classification, no sensitivity, no label. At audit time you're guessing what's actually sensitive.
Access is never reviewed
Ex-employees, guests from long-finished projects, dead distribution groups. Least privilege falls apart and the NIS2 audit is knocking at the door.
For companies that want access governance without costly IGA or scripts.
- You have tens to hundreds of groups in Entra ID (Security and Microsoft 365 / Teams) and you're losing track of them.
- You want access governance without an expensive IGA tool and without PowerShell scripts.
- A security or IT administrator needs one view — group health, risks, recertification and cleanup.
- You're addressing NIS2 or ISO 27001 and need a verifiable audit trail over access.
- You want the app to act delegated — doing nothing an administrator couldn't do themselves in Entra ID.
- You already have Microsoft 365 and Entra ID — and don't want another SaaS or a service account with elevated privileges.
- — You're after full IGA — automated joiner-mover-leaver identity provisioning from an HR system. That's Entra ID Governance or SailPoint, a different league.
- — You need entitlement management with access packages and a catalogue of permissions across apps (Entra ID P2).
- — You want privileged access management for directory roles — that's Entra PIM, not this app.
- — You don't have Entra ID / Microsoft 365. Identity Manager is a SharePoint webpart — strictly Microsoft 365 only.
- — You want to manage local on-premises Active Directory. The app works with Entra ID in the cloud; synchronised groups are read-only.
Eight things that finally make your directory make sense.
Group overview and search
One list of every group — Security and Microsoft 365 — live from Microsoft Graph. Each group shows a health score and member, owner and guest counts. Filters by type, state and management, full-text search, saved views and a ⌘K command palette to jump to any group or screen.
Classification and taxonomy
Custom classification schemes and trees — sensitivity, labels, categories. You finally know what each group is for and how sensitive it is. Bulk-classify several groups at once and record EP365 administrators next to native Entra owners.
Members, owners and dynamic rules
Manage members and Entra owners straight from the app, create new groups and define dynamic membership rules by user attribute — including ready-made rule templates. Add or remove members in bulk in one go.
Access recertification
Periodic review as a workflow: an administrator starts a round, a reviewer certifies or revokes access for each group. Deadlines, a decision history and a “to review” queue for each reviewer. No Entra ID P2 required.
Access risks
Detect least-privilege violations: groups with no owner, guests in sensitive groups, public Microsoft 365 groups, sensitive yet exposed permissions. A severity score and filter; a click opens the group detail to fix it.
Directory cleanup
Finds orphans (no owner), empty and long-unused (stale) groups, and duplicates — similar names are surfaced by diacritics-insensitive comparison and matching mail prefixes. Inline remediation and merge suggestions; the decision is always yours.
Teams and lifecycle
Provision Microsoft Teams over a Microsoft 365 group in one click. A governed lifecycle: archive as an EP365 flag (nothing is deleted in Entra ID) and controlled group deletion with confirmation — synchronised groups stay protected.
Change audit and reports
Each group's history merges the real Entra audit (directory audits) with derived EP365 events. Export membership and owners to CSV, a usage overview and the recertification decision trail — a direct basis for NIS2 and ISO 27001.
What people do with it every day.
Real situations from day-to-day operations — from an administrator at the group overview, through a security access review, to IT directory cleanup and a compliance audit.
Find ownerless groups in a minute
- Severity filter on access risks
- Click a group = detail to fix
- Bulk-add to a review
Quarterly access review
- Review-round workflow
- Reviewer certify / revoke
- Deadlines and audit history
Tidy the directory before an audit
- Orphans, empty and stale
- Duplicate-name detection
- Archive or delete
Who added a guest to payroll?
- Entra directory audit in the detail
- EP365 decision trail
- CSV export for the auditor
Four layers. All inside your M365.
No server of ours holds your data. Identity Manager is a webpart running in your SharePoint that calls Microsoft Graph delegated — on behalf of the signed-in administrator.
Where EP365 Identity Manager has a clear edge.
Security and compliance — arguments that land.
When your security team says “nothing ships until it passes review” — here's the review material.
Delegated model
The app calls Microsoft Graph as the signed-in administrator (delegated permissions), not via application permissions or a service account with elevated rights. What you can't do, the app can't do either.
Data in your M365
Groups stay in Entra ID, classification and reviews in SharePoint Lists, the audit in Entra. No server of ours holds your data; nothing leaves the tenant.
Least privilege in practice
The app itself helps enforce minimal permissions — access risks, recertification and cleanup reveal where someone has access they no longer need.
Audit trail for NIS2 / ISO
The real directory audit from Entra plus a verifiable decision trail: who certified or revoked access, and when. A basis for NIS2 and ISO 27001 access governance.
Role and licence gating
Administrator versus regular user. With an inactive licence the app runs read-only — no group mutations. Deletion is additionally protected by confirmation.
No IGA overhead
No god-mode application permissions, no service account, no extra cloud. Governance runs on the delegated Graph you already have in your Microsoft 365.
A monthly licence by company size + support as needed.
The monthly subscription depends on the size of your organisation — the total number of users in your Microsoft 365 environment. Unlimited managed groups and administrators — you pay for the size of the environment, not the number of groups.
How we set the licence price
Support pricing
Consultations, setting up classification, custom reports or preparing recertification rounds.
Support is billed per every started 15 minutes of work. The customer is informed in advance about the expected scope of work.
What it looks like in real operation.
“This year the access audit was an export, not a three-day panic.”
“For the first time in years we know what every group is for and who's accountable for it. This year the audit was a matter of an export, not panic.”
What IT and security administrators ask.
Do we need Entra ID P1 or P2?
Does the app do anything I, as an administrator, can't do myself?
Does any of our data leave the tenant?
Isn't deleting groups dangerous?
Does it work on Security and Microsoft 365 groups?
Does recertification replace Entra Access Reviews?
How do you spot duplicate groups?
Do we need PowerShell or an IT specialist?
Is it ready for NIS2 and ISO 27001?
Can it handle hundreds of groups?
Does it integrate with the other EP365 apps?
What exactly do you want to discuss?
Pick what's burning most right now. We'll get back to you, walk through your situation and propose next steps, including an indicative price.