Access Reviews: Plan, Create & Monitor

What are Access Reviews?

What can you review?

Access reviews can target four types of resources:

Review Target	What’s Being Reviewed	Example
Group membership	Who’s in this group — should they still be?	”Review all members of the Clinical Data Access group”
Application assignment	Who has access to this app — should they still?	”Review everyone assigned to the Research Portal”
Entra ID role	Who holds this role — do they still need it?	”Review all Global Administrators”
Access package	Who has this access package — do they still need it?	”Review all Research Analyst Access package holders”

💡 Exam tip: Review scope

When creating a review for a group, you can choose to review all members or only guest users. The “guest users only” option is particularly useful for B2B collaboration groups where you want to periodically verify that external users still need access.

Planning access reviews

Before creating reviews, plan these decisions:

1. Who reviews?

Reviewer Type	When to Use
Self-review	Users attest to their own need for access (low-sensitivity resources)
User’s manager	Manager confirms their direct reports still need access
Specific users	Named reviewers (e.g., app owner, security team)
Group owners	The owner of the group being reviewed

2. How often?

Feature	One-Time Review	Recurring Review
Frequency	Runs once	Weekly, monthly, quarterly, semi-annually, or annually
Best for	Project-end cleanup, audit response	Ongoing governance, compliance
Auto-recurrence	No — must manually create again	Yes — new instances created automatically
Typical use	"Review all guests added during Project X"	"Quarterly review of admin role holders"
End date	Review completes and closes	Runs until you disable it or set an end date

3. What happens when the review ends?

Setting	Behaviour
Auto-apply results	Denied users automatically lose access when the review ends
If reviewers don’t respond	Choose: no change, remove access, approve access, or follow recommendations
Recommendations	Entra ID provides a recommendation (approve/deny) based on last sign-in activity

💡 Exam tip: Machine learning recommendations

Access review recommendations are heuristics based on sign-in activity — not deterministic rules. Generally, if a user hasn’t signed in to the resource in approximately the last 30 days, the recommendation leans toward “Deny.” Recent activity leans toward “Approve.”

For group membership reviews, recommendations also consider whether the user has accessed resources through that group. These are suggestions to help reviewers make data-driven decisions — reviewers can always override recommendations. Don’t memorise “30 days = deny” as an absolute rule.

Creating an access review — step by step

ℹ️ Scenario: Priya creates a quarterly review for Clinical App access

🔐 Priya creates a recurring access review for the “Clinical Apps Users” group at Meridian Health:

1. Navigate to: Entra admin center → Identity Governance → Access reviews → New access review
2. Review type: Groups and apps
3. Scope: Select the “Clinical Apps Users” group → Review all members
4. Reviewers: User’s manager (each member’s manager reviews their access)
5. Frequency: Quarterly (every 3 months)
6. Duration: 14 days for reviewers to respond
7. Upon completion settings:
   • Auto-apply results: Yes
   • If reviewers don’t respond: Remove access (conservative approach for healthcare)
   • Show recommendations: Yes
8. Advanced settings:
   • Require reason on approval: Yes
   • Email notifications to reviewers: Yes
   • Reminders: Yes (sent partway through the review period)

Every quarter, managers receive an email asking them to review their reports’ membership. They see recommendations based on sign-in data. After 14 days, anyone denied or not reviewed loses access automatically.

Monitoring access reviews

After creating reviews, you need to monitor them:

In the Entra admin center (Identity Governance → Access reviews):

• Status dashboard — see which reviews are in progress, completed, or pending
• Progress bar — shows how many reviewers have responded vs. how many haven’t
• Results — after completion, see all decisions (approved, denied, not reviewed)

Key monitoring actions:

• Send reminders to reviewers who haven’t responded
• Download results as a CSV for compliance reporting
• View audit logs for all review decisions

ℹ️ Scenario: Anika monitors review completion across clients

🛡️ Anika Weber at Sentinel Partners manages access reviews for multiple clients. She checks the access review dashboard weekly:

• Meridian Health quarterly review: 85% complete, 3 managers haven’t responded → she sends reminders
• Financial Services annual review: Completed last week → she downloads the CSV for the compliance audit
• Government client role review: Starting next Monday → she verifies reviewer assignments are correct

Anika can filter reviews by status (Active, Completed, Scheduled) and export results at any time.

Manually responding to access reviews

Reviewers respond through myaccess.microsoft.com or the email notification link:

For each user under review, the reviewer can:

• Approve — user keeps access (optionally with a reason)
• Deny — user loses access when the review completes
• Don’t know — escalates to the next reviewer or applies the “no response” action

Bulk actions: Reviewers can accept all recommendations with one click — useful when reviewing dozens of users and the sign-in-based recommendations look correct.

💡 Exam tip: Multi-stage reviews

Access reviews support multi-stage reviews — a first-stage reviewer decides, then a second-stage reviewer validates. This is useful for sensitive resources where you want a manager to review first, then a security team to validate.

If the first-stage reviewer denies, the user is denied (no second stage needed). If the first-stage reviewer approves, it moves to the second stage for confirmation.

Video Lesson

🎬 Video coming soon

Access Reviews: Plan, Create & Monitor

Access Reviews: Plan, Create & Monitor

~10 min

Key Concepts

Question

What four types of access can access reviews target?

Click or press Enter to reveal answer

Answer

1) Group membership, 2) Application assignments, 3) Entra ID roles, 4) Access packages. Each review type checks whether users should retain their current access to that resource.

Click to flip back

Question

What happens if a reviewer doesn't respond to an access review?

Click or press Enter to reveal answer

Answer

The admin-configured 'no response' action applies. Options: No change (user keeps access), Remove access, Approve access, or Follow recommendations (use the system's sign-in-based suggestion). The choice depends on how conservative your security posture is.

Click to flip back

Question

How does Entra ID generate access review recommendations?

Click or press Enter to reveal answer

Answer

Based on sign-in activity heuristics. No recent sign-in (~30 days) → recommend Deny. Recent activity → recommend Approve. These are suggestions, not hard rules — reviewers can always override.

Click to flip back

Question

What is auto-apply in access reviews?

Click or press Enter to reveal answer

Answer

When auto-apply is enabled, denied users automatically lose access when the review period ends — no manual intervention needed. Without auto-apply, an admin must manually apply the review results.

Click to flip back

Knowledge Check

Knowledge Check

Priya needs to ensure that guest users in the 'External Researchers' group are reviewed every 6 months. If a reviewer doesn't respond, guest access should be removed. What should she configure?

AA one-time access review of all group members with auto-apply enabledBA recurring access review scoped to guest users only, with semi-annual frequency, auto-apply enabled, and 'Remove access' as the no-response actionCA Conditional Access policy that blocks guests after 180 daysDAn entitlement management policy with 180-day expiration on the access package

Check Answer

Knowledge Check

Anika notices that an access review for Entra admin roles has been running for 12 days with only 60% of reviewers responding. The review period is 14 days, and the no-response action is set to 'No change.' What should Anika do?

AWait for the review to complete — the no-response action will handle itBSend reminders to non-responding reviewers and consider extending the review period if neededCImmediately close the review and deny all non-reviewed usersDDelete the review and create a new one with a longer review period

Check Answer

Knowledge Check

Which of the following is TRUE about access review recommendations in Entra ID?

ARecommendations are based on the user's job title and departmentBRecommendations are based on the user's sign-in activity to the resource over the last 30 daysCRecommendations always recommend approval to avoid disruptionDRecommendations require Microsoft Entra ID P1 licensing

Check Answer

---

Next up: PIM: Protect Your Privileged Roles — how to use Privileged Identity Management to secure admin roles with just-in-time activation, approvals, and time limits.