Skip to content

Access Reviews

Access reviews are scheduled, recorded checks that each person who holds access still needs it. Access is easy to grant and rarely taken away: people change roles, projects end and guests stay long after the work is done. Reviews catch this build-up, remove what is no longer needed, and leave evidence that someone checked.

Current state

No access reviews are configured in the tenant yet. Today, the only recertification is built into the Tier 0 access packages. Each assignment expires after 90 days, and the user must request it again and be approved again. That covers privileged access through packages, but nothing else. This page sets out the review model to put in place.

Why reviews are needed

Approval controls who gets access. Reviews control who keeps it. Without them:

  • Access builds up as people move between roles, because nobody removes the old access.
  • Guest and partner accounts outlive the work they were invited for.
  • Access that was assigned directly, outside packages and PIM, is never looked at again.
  • There is no evidence for auditors that access is checked regularly.

Reviews support NIST SP 800-53 AC-2 (account management: review accounts at a set frequency) and AC-6(7) (review of user privileges: confirm privileges are still needed, and remove them if not).

How access reviews work

An access review is an Entra ID Governance feature. Each review has:

Setting What it decides
Scope What is reviewed: a group's members, an app's users, an access package's assignments, or who holds an Entra directory role or Azure role (through PIM)
Reviewers Who decides: group owners, the users' managers, named reviewers, or users reviewing their own access
Frequency One-off, or recurring (monthly, quarterly, semi-annual or annual)
Auto-apply Whether decisions are carried out automatically when the review ends
If reviewers don't respond Keep access, remove access, or follow Entra's recommendation
Recommendations Entra suggests "deny" for users who haven't signed in for 30 days, to help reviewers decide

Licensing

Access reviews need Microsoft Entra ID P2 or Microsoft Entra ID Governance licences for the users in scope.

What to review

Reviews should cover the access that approval and expiry don't already handle, starting with the highest risk.

Scope Frequency Reviewers If no response Why
Tier 0 directory and Azure roles held outside access packages (PIM role reviews) Quarterly Security lead, not the role holders Remove Anything assigned directly bypasses the package approval and 90-day expiry. Apart from break-glass accounts, the target is zero.
sg-priv-tier-0-approvers membership Quarterly Security lead Remove This group approves all Tier 0 requests. If it grows unchecked, separation of duties (AC-5) is weakened.
sg-priv-tier-0-requestors membership Quarterly Platform lead Remove Controls who can even request Tier 0 access.
Break-glass accounts Quarterly Security lead Keep, and investigate Confirms the accounts still exist, are excluded as intended, and have not been used without an incident record.
Platform groups (grp-*) Semi-annual Group owners Follow recommendation Standing, non-privileged platform access. Lower risk, but it still builds up.
Per-subscription RBAC groups Semi-annual Workload owners Follow recommendation Owners know best who still works on their subscription.
Guest users Quarterly Inviting sponsor or group owner Remove Guests are the most common source of stale access.

Two areas don't need separate reviews:

  • Tier 0 access packages. Assignments expire after 90 days and must be approved again. Expiry works as a built-in review. Add a mid-term review only if you lengthen the duration.
  • Machine identities. Platform service principals are declared in code, so the repository is the inventory and every change goes through an MR (see Platform Service Principal Vending). Review them by reviewing the repository.

Reviewer rules

  • Never let people review their own privileged access. Self-review is acceptable only for low-risk standing access.
  • Tier 0 reviewers must not be the same people who approve Tier 0 requests. Otherwise the review repeats the approval decision instead of checking it.
  • Always turn on auto-apply. A review whose decisions are never carried out is only paperwork.

Who can configure reviews

Review type Role needed Tier
Groups, apps and access packages Identity Governance Administrator Tier 0 by mechanism
Entra directory roles (PIM) Privileged Role Administrator Tier 0
Azure roles (PIM) Owner or User Access Administrator on the resource Depends on scope. Tier 0 at the tenant root and mg-intermediate-root.

The Identity & Access Governance Admin access package already bundles Identity Governance Administrator for this purpose. Setting up reviews is a Tier 0 action, so treat it the same way as other Tier 0 changes.

Managing reviews as code

There are two options, and they can be used together:

  1. Access package assignment reviews. The azuread provider's azuread_access_package_assignment_policy supports an assignment_review_settings block. This adds recurring reviews directly to the existing Tier 0 access packages. The shared terraform-azuread-access-package module would need a new input to expose it.
  2. Standalone reviews (groups, guests and PIM roles). The azuread provider has no resource for these. They can be managed through Microsoft Graph (identityGovernance/accessReviews/definitions) with the msgraph provider, which the access packages deployment already uses. The deployment's identity would need the AccessReview.ReadWrite.All Graph application permission, which it does not have today.

Until then, create reviews in the portal: Entra admin center → Identity Governance → Access reviews.

Evidence and follow-up

  • Review history is kept in Entra ID. You can download the results of each review from the portal.
  • Review decisions are also written to the Entra audit log, which Entra ID Diagnostic Settings streams to the central workspace. That gives them the same 2-year archive as other audit evidence.
  • After each cycle, check for reviews that closed with no decisions. A review nobody completed means the reviewer assignment needs fixing.