Entra ID Access Reviews

Entra ID Access Reviews allow administrators to create recurring or one-time reviews of user access to groups, applications, and Azure AD roles. The goal is to ensure that only the right people have access to sensitive resources. Access Reviews are part of Microsoft's Identity Governance capabilities within Microsoft Entra ID (formerly Azure Active Directory). They help organizations meet compliance requirements (e.g., SOX, GDPR) by providing evidence of periodic access certification.

Over time, users accumulate access rights—they change roles, leave teams, or leave the organization. Without regular audits, former employees or contractors may retain access to critical systems. Access Reviews automate the certification process: a reviewer (typically a manager or resource owner) approves or denies each user's continued access. If denied or not responded to, access is automatically removed. This enforces the principle of least privilege and reduces the attack surface.

- Azure AD roles (e.g., Global Administrator) - Azure AD groups (security groups, Microsoft 365 groups) - Application access (enterprise applications) - Reviewers: Who performs the review? Options:

- Group owner(s) - Selected users or groups (e.g., security team) - Users themselves (self-review) - Manager of each user (dynamic: the system identifies each user's manager) - Duration: How long does the reviewer have to respond? Default is 30 days, configurable from 1 to 180 days. - Recurrence: One-time or recurring (e.g., weekly, monthly, quarterly, annually). - Auto-apply: If set, decisions are applied automatically after the review ends. If not, an administrator must manually apply results. - Fallback reviewers: If a reviewer has not responded, a fallback reviewer can be assigned to handle outstanding decisions. - Decisions: Approve, Deny, or Not Reviewed. 'Not Reviewed' is treated as a denial if auto-apply is enabled.

- Approve (keep access) - Deny (remove access) - Skip (no decision, treated as Not Reviewed) - Add a reason (optional) Reviewers can also bulk approve/deny. 4. Reminders: The system sends periodic reminders (configurable) to reviewers who haven't completed their review. 5. End of Review: Once the duration expires, the review ends. If auto-apply is enabled, all 'Deny' and 'Not Reviewed' decisions result in access removal. If auto-apply is off, an administrator must manually apply the results. 6. Access Removal: When a decision is applied, the user is removed from the group, role, or application assignment. For Azure AD roles, this means the user loses the role's permissions. For groups, the user is removed from the group membership. For applications, the user's assignment to the enterprise application is removed.

Access Reviews are created via the Entra ID admin center under Identity Governance > Access Reviews. Alternatively, you can use Microsoft Graph API or PowerShell.

Example PowerShell snippet to create a one-time access review for a group:

New-MgIdentityGovernanceAccessReviewDefinition `
  -DisplayName "Quarterly Sales Group Review" `
  -DescriptionForAdmins "Review access to Sales group" `
  -Scope @{"@odata.type"="#microsoft.graph.accessReviewQueryScope"; "query"="/groups/group-id/members"; "queryType"="MicrosoftGraph"} `
  -Reviewers @(@{query="/users/user-id"; queryType="MicrosoftGraph"}) `
  -Settings @{
    mailNotificationsEnabled=$true;
    reminderNotificationsEnabled=$true;
    justificationRequiredOnApproval=$true;
    defaultDecisionEnabled=$false;
    autoApplyDecisionsEnabled=$false;
    recommendationsEnabled=$true;
    durationInDays=30;
    recurrence=@{pattern=@{type="absoluteMonthly"; interval=3}; range=@{type="noEnd"}}
  }

Verification: After the review ends, check the results under Identity Governance > Access Reviews > Select the review > Review instances. You can see decisions, export a CSV report, and apply results.

A financial services company must comply with SOX by certifying all users with Global Administrator access every quarter. The security team creates a recurring quarterly access review for the 'Global Administrator' Azure AD role. The reviewer is the IT Director. The review duration is set to 14 days, with auto-apply enabled and recommendations on. Each quarter, the IT Director receives an email with a list of current Global Administrators. The system recommends denying access for any admin who hasn't signed in for 30 days. The director approves necessary users and denies others. After 14 days, denied users lose Global Admin rights automatically. This process reduces standing privileged access and provides auditable evidence. Common pitfalls: forgetting to set auto-apply (results not applied automatically) or setting too short a duration (reviewers may miss the window). Production scale: reviewing up to 50 Global Admins per review is typical.

A multinational corporation uses Microsoft Teams extensively with external partners. They need to ensure guest access is reviewed every month. They create a recurring monthly access review for all Microsoft 365 groups that contain guests. The reviewers are the group owners (each team's owner). Duration is set to 7 days, auto-apply enabled, and recommendations on. Each month, team owners review guest members and deny those who no longer need access. If a guest is denied, they are removed from the team. This prevents former partners from accessing sensitive channels. Common misconfiguration: not enabling 'Guest users only' scope, leading to review of all members (including employees) which increases reviewer workload. Also, if auto-apply is off, an admin must manually apply, which may be forgotten. Performance: reviewing thousands of guests across hundreds of groups is feasible; the system handles up to 50,000 users per review.

A SaaS company wants employees to confirm they still need access to a critical HR application. They create a one-time access review for the enterprise application 'HR Portal' with self-review as the reviewer type. Duration is 30 days. Auto-apply is enabled. Employees receive an email to approve or deny their own access. If an employee does not respond, their access is automatically removed. This empowers users to clean up their own access. However, a common issue is that employees may not understand the process and ignore the email, leading to unintended loss of access. To mitigate, the company sets a fallback reviewer (the HR director) who can re-approve if needed. Also, notifications are sent weekly. Production scale: up to 10,000 employees can be reviewed in a single review.