External companies confirm their consultants
Each external company confirms on a cadence who still works for them; a consultant reported as gone is disabled at once.
Purpose
You rarely hear when a consultant leaves their company - their account simply keeps working.
Design
Register each external company with its contacts, its sponsor department and a review cadence. On that cadence the contacts receive the list of their consultants and confirm who still works for them. A consultant reported as gone is disabled at once, and removing their access waits for an internal approver, so access is not removed on an outside party's word alone.
Business opportunities
Third-party access is reviewed by the people who actually know, closing one of the most common audit findings.
Related features
Access map: your delegation model on one board
Pick a person or a permission and see every path in your delegation model - people, their groups, what those groups include and the roles and scopes they grant.
Who can do what - and who can activate this role
Pick a person to see the targets they can reach, or pick a role to see who can activate it - each with the exact path that grants it.
Look up a role: find the least-privileged role for the job
See what an Entra ID role can do in plain words, find the roles that grant an action ranked least-privileged first, see who can activate a role, or compare two roles.
PIM Activator: activate the access you need, together
A browser extension for Edge and Chrome: tick the groups and roles you need, give one justification and activate them together - three clicks for a typical activation.