---
title: Approval requirement disabled on Azure AD Identity Governance access package
description: Datadog, the leading service for cloud-scale monitoring.
breadcrumbs: >-
  Docs > Datadog Security > OOTB Rules > Approval requirement disabled on Azure
  AD Identity Governance access package
---

> For the complete documentation index, see [llms.txt](https://docs.datadoghq.com/llms.txt).

# Approval requirement disabled on Azure AD Identity Governance access package
Classification:attackTactic:[TA0003-persistence](https://attack.mitre.org/tactics/TA0003)Technique:[T1098-account-manipulation](https://attack.mitre.org/techniques/T1098) 
## Goal{% #goal %}

Detects when the approval requirement on an Entra Identity Governance access package assignment policy is disabled.

## Strategy{% #strategy %}

This rule monitors Microsoft Entra audit logs for the `Update access package assignment policy` activity, where a `targetResources` modified property with `modifiedProperties.displayName` of `IsApprovalRequiredForAdd` is set to a `modifiedProperties.newValue` of `False`. Access packages in Identity Governance bundle roles, group memberships, and application access into a single assignable unit, and each package is governed by an assignment policy that can require manager or resource-owner approval before a user is granted access. Setting `IsApprovalRequiredForAdd` to `False` removes that approval gate, allowing any user in the eligible scope to self-assign the underlying access without human review.

## Triage & Response{% #triage--response %}

- Examine whether `{{@ocsf.actor.user.uid}}` is an Identity Governance or Entra ID administrator with a legitimate reason to modify assignment policy approval settings.
- Identify which access package the modified policy governs and what roles, groups, or application access it grants.
- Check whether `{{@ocsf.actor.user.uid}}` or other actors used the newly unapproved self-assignment path to grant themselves or others elevated access.
- Determine if the policy change was reverted or if approval remains disabled, and confirm whether a change ticket or governance request authorized the modification.
- Review other recent administrative activity by `{{@ocsf.actor.user.uid}}` to identify additional configuration changes that may indicate broader account compromise or insider misuse.