Entitlement Management - when create access package, approval request not send to Guest Sponsor

Question

Entitlement Management - when create access package, approval request not send to Guest Sponsor

XY 0

Hi,

I created an access package using the “User not in your organization” option. When selecting an approver, there are three choices: Internal Sponsor, External Sponsor, and Specific Approver.

Could you explain what Internal Sponsor and External Sponsor mean in this context? Is there any documentation I can refer to?

Shubham Sharma 13,320 Reputation points Microsoft External Staff Moderator

2026-03-31T06:15:11.4933333+00:00
Hello XY

Thank you for reaching out to Microsoft Q&A.

You’re configuring an access package for “Users not in your organization” and wondering what the Sponsor options mean. Here’s the quick rundown:

• Internal Sponsor

– A user (or group) in your Azure AD tenant who you designate to vouch for and approve external (guest) requests.

– You pick from users already in your directory.

• External Sponsor

– A user in the requester’s home tenant (a “connected organization”) who you’ve configured as a sponsor.

– This requires you first set up a Connected Organization in Entitlement Management and list one or more users there as external sponsors.

• Specific Approver

– Any user or security group (internal only) that you explicitly pick to approve requests.

So if you want someone outside your tenant (for example, in a partner’s Azure AD) to approve their own colleagues’ requests, use External Sponsor. If you want one of your own employees to approve those guest requests, use Internal Sponsor.

Microsoft docs:

Create an access package → Specify approval settings https://learn.microsoft.com/entra/id-governance/entitlement-management-access-package-create#specify-approval-settings

Request process & notifications (overview of sponsors/managers) https://learn.microsoft.com/azure/active-directory/governance/entitlement-management-process

Delegation & roles in Entitlement Management (how to define sponsors) https://learn.microsoft.com/azure/active-directory/governance/entitlement-management-delegate

Let us know the above steps helps.

Thank you
XY 0 Reputation points

2026-03-31T06:22:45.3033333+00:00

Thanks @Shubham sharma , So, where can I configure the internal sponsor? And if I add a guest user who already exists in my tenant, will the guest’s sponsor receive the approval request?

Shubham Sharma 13,320 Microsoft External Staff Moderator

Thank you for your reply.

You do not configure Internal Sponsors globally.

They are selected directly in the access package approval policy.

How it works:-

When you configure an access package for “Users not in your organization”, and choose Internal sponsor as the approver:

Microsoft Entra ID automatically looks at the guest user’s Sponsors field
The sponsor must be an internal user or group in your tenant
The sponsor is configured on the guest user object, not in the access package

There is no separate “Internal Sponsor” setting page in Entitlement Management.

This is explicitly tied to the B2B Sponsors feature, not to access packages themselves.

For your reference: https://learn.microsoft.com/en-us/entra/external-id/b2b-sponsors

How do you actually set an Internal Sponsor?

You configure it on the guest user account.

Option A- During Guest Investigation

When inviting a guest user:

Entra admin center → Users → New user → Invite external user
On the Properties / Job information section
Add one or more users/groups under Sponsors

If you don’t specify one:

The inviter is automatically added as the sponsor

Option B- After the guest already exist

For an existing guest user:

Entra admin center → Users → select guest → Edit
Add internal users or groups in the Sponsors field

This sponsor is what Entitlement Management uses when you select Internal sponsor as the approver.

If you add a guest user who already exists — will their sponsor get the approval?

Yes — but only if ALL of the following are true:


Condition	Required
Guest user has Sponsors populated	✅
Sponsor is an internal user/group	✅
Access package approval is set to Internal sponsor	✅
Guest is requesting access via My Access / link	✅

If any of these are missing, no approval request will be sent, which often looks like a “silent failure”.

sponsors can be used as approvers in entitlement management, but only when configured correctly on the user object.

Important distinction: Internal vs External Sponsor


Type	Where configured	Who receives approval
Internal Sponsor	On the guest user object	Internal user/group in your tenant
External Sponsor	On a Connected Organization	User in the external tenant
Specific Approver	Access package policy	Internal user/group you select

External Sponsors:

Are configured under Identity Governance → Connected organizations
Must be explicitly added there
Only apply if the requestor belongs to that connected organization

Reference: Manage connected organizations in entitlement management | Azure Docs

Why approval requests often don’t get sent

Guest user has no sponsor assigned
Sponsor exists but is external, while approval expects internal sponsor
Access package uses Internal sponsor, but guest came from a Connected Org expecting External sponsor
Guest was manually assigned the access package (bypasses approval)
Approval policy is disabled or misconfigured

Let us know if you have any questions.

Thanks

1 answer

Your answer

Shubham Sharma 13,320 Reputation points Microsoft External Staff Moderator

2026-03-31T06:15:11.4933333+00:00

Hello XY

Thank you for reaching out to Microsoft Q&A.

You’re configuring an access package for “Users not in your organization” and wondering what the Sponsor options mean. Here’s the quick rundown:

• Internal Sponsor

– A user (or group) in your Azure AD tenant who you designate to vouch for and approve external (guest) requests.

– You pick from users already in your directory.

• External Sponsor

– A user in the requester’s home tenant (a “connected organization”) who you’ve configured as a sponsor.

– This requires you first set up a Connected Organization in Entitlement Management and list one or more users there as external sponsors.

• Specific Approver

– Any user or security group (internal only) that you explicitly pick to approve requests.

So if you want someone outside your tenant (for example, in a partner’s Azure AD) to approve their own colleagues’ requests, use External Sponsor. If you want one of your own employees to approve those guest requests, use Internal Sponsor.

Microsoft docs:

Create an access package → Specify approval settings https://learn.microsoft.com/entra/id-governance/entitlement-management-access-package-create#specify-approval-settings

Request process & notifications (overview of sponsors/managers) https://learn.microsoft.com/azure/active-directory/governance/entitlement-management-process

Delegation & roles in Entitlement Management (how to define sponsors) https://learn.microsoft.com/azure/active-directory/governance/entitlement-management-delegate

Let us know the above steps helps.

Thank you
XY 0 Reputation points

2026-03-31T06:22:45.3033333+00:00

Thanks @Shubham sharma , So, where can I configure the internal sponsor? And if I add a guest user who already exists in my tenant, will the guest’s sponsor receive the approval request?

Answer 1

In entitlement management, Internal sponsor and External sponsor are approver types used specifically for policies that govern access for users not in your directory (external users/B2B guests).

Internal sponsor

An internal sponsor is a user in your own Microsoft Entra directory who is designated as the sponsor for external users from a connected organization.
When selected as an approver in an access package policy For users not in your directory, the approval request is routed to the internal sponsor(s) defined for that connected organization.
This is typically someone in your organization who is responsible for overseeing and approving access for external collaborators.

External sponsor

An external sponsor is a user in the external/connected organization who is designated as the sponsor for their own users.
When selected as an approver in a policy For users not in your directory, the approval request is routed to the external sponsor(s) configured for that connected organization.
This allows the partner organization to control or co‑approve which of their users get access to your resources.

Where this is configured and used

For access packages that allow For users not in your directory, the first approver can be set to External sponsor, Internal sponsor, or Choose specific approvers. The same options appear for second/third approvers in multi‑stage approval, depending on whether the users are in or out of your directory.
Sponsors are resolved from the user’s profile attributes (Sponsors attribute) and from the configuration of the Connected organization that you associate with the access package.

Relevant documentation in the provided context

The behavior and options for Internal/External sponsor as approvers are described in the approval settings for access packages that govern users not in your directory, and in the tutorial for onboarding external users where Internal sponsor is explicitly chosen as the approver.

References:

Share via

Entitlement Management - when create access package, approval request not send to Guest Sponsor

1 answer

Your answer