How to find deleted Approvers in Entra ID Governance Access Packages Using PowerShell

When you offboard users and ultimately delete their user accounts, something that can easily be forgotten is that the user may be an approver in an access package in Entra ID Governance. What happens is when you delete the user in Entra ID (via AD Connect sync or otherwise), the user will still be present on the list of approvers even though the user has been deleted. There is of course the fallback approver, but that can significantly slow down the approval process.

If you have never thought about this or don’t have a process for handling approvers that get offboarded, it can be hard to get an overview of which access package policies have approvers that are no longer found in Entra ID.

I decided to create a PowerShell script to go over every access package policy and check if the approvers still exist in Entra ID, because Microsoft Graph will output the approvers even though one or more users are not found in Entra ID.

You can use the below PowerShell script to find approvers that are no longer found in Entra ID.

I hope this PowerShell scripts can help you clean up your access packages! 😊