Microsoft Entra Access Reviews

Microsoft Entra Access Reviews (formerly Azure AD Access Reviews) are a feature of Microsoft Entra ID Governance that enables organizations to periodically review and certify user access to groups, applications, and privileged roles. The primary purpose is to ensure that only the right people have the right access, reducing the risk of stale permissions, insider threats, and compliance violations. Access Reviews are a key tool for achieving least-privilege security and meeting regulatory requirements such as SOX, HIPAA, and GDPR.

In any organization, users accumulate access over time—through role changes, project assignments, or temporary grants. Without periodic reviews, former employees, contractors, or users who changed roles may retain access to sensitive resources. This creates security vulnerabilities and compliance gaps. Access Reviews automate the certification process by prompting designated reviewers (e.g., managers, resource owners) to confirm or deny each user's access. The results can be automatically enforced, removing access for users who are not approved or whose reviewers did not respond.

An Access Review is defined by a review policy that specifies: - What is being reviewed: A group, application, or privileged role (e.g., Azure AD roles, Azure resource roles). - Who is reviewed: All members or direct assignments within the scope. - Who reviews: One or more reviewers. Options include:

- Group owner(s) - Selected users or groups (e.g., managers) - Users review their own access (self-review) - Frequency: One-time or recurring (e.g., weekly, monthly, quarterly, annually). - Duration: How long reviewers have to respond (default 30 days, configurable from 1 to 180 days). - Auto-apply: If enabled, when the review ends, the system automatically removes access for denied users or users whose reviewers did not respond. If disabled, an administrator must manually apply the results. - Fallback reviewers: If the primary reviewer does not have a manager or is unavailable, a fallback reviewer is assigned.

When a review starts, the system sends an email to each reviewer with a link to the review dashboard. Reviewers see a list of users and can approve or deny each one. They can also provide a justification. The reviewer can also delegate the review to someone else. The review status is tracked in real-time. Once the review period ends, the system applies the decisions based on the auto-apply setting. All actions are logged in the Microsoft Entra audit log.

Access Reviews are configured through the Microsoft Entra admin center or Microsoft Graph API. There are no PowerShell cmdlets for creating reviews in the current release (as of 2025), but you can use Microsoft Graph API. However, for SC-900, you only need to know the admin center steps:

To verify review results:

Example Graph API call to list reviews:

GET https://graph.microsoft.com/v1.0/identityGovernance/accessReviews/definitions

A company wants to review all members of the "Finance - Sensitive Documents" group every quarter. They configure:

When the review starts, the group owners receive an email. They review each member and approve or deny. After 14 days, the system automatically removes access for any denied members or members whose owners did not respond. The audit log records every decision.

A large financial institution must comply with Sarbanes-Oxley (SOX) requirements, which mandate periodic certification of access to financial systems. They use Access Reviews to review membership in the 'SAP Finance' security group every quarter. The group has 500 members. The review is configured with:

In production, the reviewer receives an email with a list of 500 users. To avoid overwhelming the reviewer, the organization also uses a 'self-review' phase before the manager review: users must first confirm they still need access. Only users who do not respond or deny themselves are forwarded to the manager. This is achieved by creating a two-stage review, though the standard Access Review only supports a single reviewer per user. In practice, the organization uses a custom workflow with Entitlement Management to achieve multi-stage reviews. Common issues: reviewers ignoring emails, leading to mass auto-removals and helpdesk calls. Mitigation: send reminder emails at day 7 and day 14, and train managers to delegate if on leave.

A tech company uses Privileged Identity Management (PIM) for Azure AD roles, but also has permanent assignments for some roles (e.g., User Administrator). To comply with internal security policy, they run a monthly Access Review of all Azure AD role assignments. The review scope includes both eligible and active assignments. Reviewers are the global administrators. Duration: 7 days. Auto-apply is disabled because the security team wants to manually verify before removing access. After the review, the security team exports the results to a CSV and runs a script to remove denied assignments via Graph API. They also use the audit log to track who approved or denied. Pitfall: if auto-apply is off and the administrator forgets to apply, stale access persists. Best practice: enable auto-apply with a sufficient duration to allow time for manual intervention if needed.

A multinational corporation uses Access Reviews to manage guest user access to Microsoft Teams. Every month, guest users are asked to self-review their access to a 'Vendor Collaboration' group. The review is configured with:

In production, guests receive an email in their own mailbox. Many guests do not respond because they ignore the email or it goes to spam. The auto-apply removes their access after 14 days, causing disruption. To reduce false positives, the organization sets the duration to 30 days and sends a reminder after 15 days. They also require justification for self-approval to prevent guests from blindly approving. The audit log helps track compliance for GDPR data processing agreements.