Access Reviews and Governance

Azure AD Access Reviews are a feature of Azure AD Identity Governance that enables organizations to periodically review and certify user access to groups, applications, and Azure AD roles. The primary purpose is to enforce the principle of least privilege and comply with regulatory requirements (e.g., SOX, GDPR, HIPAA) by ensuring that only authorized users retain access. Without access reviews, permissions can accumulate over time, leading to security risks such as privilege creep, dormant accounts, and insider threats.

Access Reviews are part of a broader identity governance strategy that includes entitlement management, privileged identity management (PIM), and terms of use. The exam expects you to understand how access reviews fit into this ecosystem, particularly how they can be used to review PIM-eligible roles and dynamic group memberships.

An access review is essentially a workflow that consists of the following components:

- A single Azure AD group (security or Microsoft 365) - An application assigned to users via Azure AD Enterprise Applications - Azure AD roles (including PIM-eligible roles) - All users with guest access to a tenant (the "Guest users" scope) - Reviewers: The people who perform the review. Options include:

- Group owners (for group reviews) - User's manager (requires Azure AD Premium P2) - Selected users or groups (e.g., a security team) - Self-review (users review their own access) - Review cycle: A single review or recurring (weekly, monthly, quarterly, semi-annually, annually). - Auto-apply settings: Determines whether denied access is automatically removed after the review ends, or if manual action is required. - Remediation actions: What happens to denied users: remove from group, remove app assignment, or deactivate role.

When a review starts, Azure AD generates a list of users and their access. Reviewers receive an email notification and can access the review via the Azure portal or the My Access portal (https://myaccess.microsoft.com). Each reviewer must decide to "Approve" or "Deny" for each user. Optionally, reviewers can provide a justification. The review runs for a defined duration (default 30 days, configurable from 1 to 90 days). After the review period ends, if auto-apply is enabled, Azure AD automatically executes the remediation actions for denied users. If auto-apply is disabled, an administrator must manually apply the results.

Access reviews are configured primarily through the Azure portal under Azure Active Directory > Identity Governance > Access Reviews. However, you can also use Microsoft Graph API and PowerShell.

PowerShell example to create a new access review:

# Connect to Azure AD
Connect-AzureAD

# Create a new access review for a group
New-AzureADMSAccessReview `
  -DisplayName "Quarterly Sales Group Review" `
  -Scope @{"query"="/groups/12345678-1234-1234-1234-123456789012"} `
  -ReviewerType "manager" `
  -StartDateTime (Get-Date).ToString("yyyy-MM-ddTHH:mm:ssZ") `
  -DurationInDays 30 `
  -AutoApplyDecisionsEnabled $true `
  -DefaultDecisionEnabled $true `
  -DefaultDecision "Deny" `
  -InstanceDurationInDays 30 `
  -RecurrenceSettings @{
      recurrenceType = "monthly"
      recurrenceEndType = "never"
      } `
  -JustificationRequired $true

Verification: You can list active reviews with:

Get-AzureADMSAccessReview | Format-List Id, DisplayName, Status

Common wrong answers on the exam:

In a large enterprise with thousands of employees, access reviews are a critical governance process. For example, consider a multinational corporation that uses Azure AD to manage access to its ERP application. The ERP team creates an Azure AD group named 'ERP-Users' and assigns the application to that group. Over time, employees move between departments, but their membership in the ERP group is not automatically updated. To enforce least privilege, the identity team creates a quarterly access review for the ERP-Users group. They select the user's manager as the reviewer (requiring P2 licenses for all users) and set the default decision to 'Deny' with auto-apply enabled. This ensures that if a manager does not respond within 30 days, the user loses access. In production, this review covers 5,000 users across 200 managers. The identity team uses the 'Recommendation' feature to help managers decide: Azure AD analyzes each user's recent sign-ins to the ERP app and suggests approval only if the user has logged in within the last 90 days. This reduces the manual effort by 40%.

Another scenario involves reviewing guest access. A company collaborates with external partners and has thousands of guest users. They create an access review scoped to 'Guest users' with self-review: each guest must confirm they still need access. The default decision is set to 'Deny' and auto-apply enabled. Guests who do not respond within 30 days are automatically removed from all Azure AD resources. This prevents orphaned guest accounts from becoming a security risk. A common misconfiguration is setting the default to 'Approve', which would allow stale guests to retain access.

A third scenario is reviewing Azure AD roles. A company uses PIM to grant eligible assignments to the Global Administrator role. To ensure that only necessary users maintain eligibility, they create a monthly access review for the Global Administrator role, with the security team as reviewers. They set 'If reviewers don't respond' to 'Deny' and auto-apply enabled. This ensures that any administrator who is not explicitly approved loses eligibility. A common pitfall is not enabling auto-apply, leaving the review results unapplied and the role assignments unchanged. The identity team monitors the review using PowerShell scripts to export results and audit compliance.

Scale considerations: For large reviews (over 10,000 users), the review portal may experience latency. Microsoft recommends breaking reviews into smaller scopes (e.g., by department). Also, reviewer fatigue can lead to inaccurate decisions; using recommendations helps. Performance-wise, the auto-apply process can take up to 24 hours for large reviews. Misconfigurations often occur when setting the recurrence: if you set a monthly recurrence with a 30-day duration, the next instance starts immediately after the previous ends, which may not leave time for analysis. Best practice is to set a gap by using a shorter duration or a longer recurrence interval.