Skip to content
MitoMito Docs

MT.1110: No catalog should contain resources without any associated access packages.
ID MT.1110
Severity Low
Suite Mito
Product Entra ID
Feature Identity Governance
Security area Identity lifecycle and hygiene
Resource type AccessPackage
User impact of fixing Low
Effort to fix Medium
Reads from Microsoft Graph
Licence needed AAD_PREMIUM_P2, Entra_Identity_Governance

What this checks and how to fix it

Section titled “What this checks and how to fix it”

This test identifies Microsoft Entra ID Governance access package catalogs that contain resources (groups, applications, SharePoint sites) that are not used in any access package within that catalog. Orphaned resources indicate incomplete configuration or drift.

The test validates:

  • All catalog resources are referenced in at least one access package
  • No orphaned or unused resources exist in catalogs
  • Resources serve their intended governance purpose

Common scenarios detected:

  • Resources added to catalog but package not yet configured
  • Access package was deleted but resource remained in catalog
  • Resources removed from packages but not from catalog
  • Test resources added and never cleaned up

Remediation action

Section titled “Remediation action”

Option 1: Add to Access Package (if resource should be governed)

  1. Navigate to Entra Admin Center → Identity Governance → Catalogs
  2. Open an existing access package or create a new one
  3. Add the resource to the package’s resource roles
  4. Configure appropriate roles and permissions
  5. Update package policies as needed

Option 2: Remove from Catalog (if resource no longer needed)

  1. Navigate to Entra Admin Center → Identity Governance → Catalogs
  2. Select the catalog → Resources section
  3. Select the unused resource
  4. Click Remove from catalog
  5. Confirm removal

Bulk Remediation Process:

  1. Review with stakeholders to identify which resources are still needed
  2. Create access packages for resources that should be governed
  3. Clean up catalog by removing resources no longer needed
  4. Document decisions and update procedures
Section titled “Related links”

Mito check. Author: nicowyss; contributors: JeanPhilippeGeorge. Open-source licences.

Open-source licences. CIS Benchmark material © Center for Internet Security, Inc.; CISA SCuBA baselines are public domain (CC0).

© 2026 Virtual Petals. Mito is a Virtual Petals service, hosted in Microsoft Azure UAE North.