What Are Azure AD Access Reviews? Microsoft Entra Access Reviews Explained

What Are Azure AD Access Reviews? Microsoft Entra Access Reviews Explained

Originally published 15 October 2020 · Reviewed 5 November 2026

Access tends to accumulate. People change jobs, projects end, and guests keep access long after the collaboration finished. Access reviews in Microsoft Entra, formerly Azure AD access reviews, give you a repeatable way to ask "does this person still need this?" and to act on the answer. This article explains what you can review, who decides, and how to set up reviews that people complete.

What you can review

Microsoft documents access reviews for several kinds of access:

• membership of security groups and Microsoft 365 groups, including Teams;
• user assignments to enterprise applications;
• assignments to Microsoft Entra roles and Azure resource roles, usually together with Privileged Identity Management;
• guest users who have been invited to your tenant, so you can remove external accounts that are no longer needed;
• access packages in entitlement management.

Pick the places where unneeded access would cost you most: privileged roles, finance and HR groups, groups with access to sensitive SharePoint sites, and guest accounts.

Who reviews

You choose the reviewers, and the choice matters more than the technical settings:

• Group or application owners know why the access exists.
• Managers know whether their team members need it.
• The users themselves can confirm they still use the access, although self-review is the weakest option for security.
• Specific named reviewers, such as a security lead, suit privileged roles.

You can add fallback reviewers if the primary reviewer does not respond. For guests, reviewers can be the people who sponsor the guest relationship.

Settings that decide whether reviews work

• Frequency. One-off or recurring weekly, monthly, quarterly, semi-annual or annual.
• Duration. How long reviewers have to respond. Too short and people miss it; too long and the review drags.
• Decision help. Recommendations based on sign-in activity can help reviewers see who has not used the access.
• Justification. Require a reason for approving, so the decision is meaningful.
• Auto-apply results. If enabled, access is removed automatically when the reviewer denies it, or when no one responds and you set the default decision to deny.
• Reminders and notifications. Reviewers need nudges.

A common mistake is turning on auto-apply with a default of deny for the first run, before reviewers understand the process. Run the first review without auto-apply, check the results, then enable it.

Licensing

Microsoft's licensing page says access reviews need Microsoft Entra ID Governance for the full set of capabilities, and that capabilities previously available with Microsoft Entra ID P2 still work with P2. It lists licence requirements for the people being reviewed and for reviewers, with guest reviews subject to a separate billing model. Licensing details have moved over time, so check the current table before you plan.

A rollout plan

1. Start small. Choose one high-value group, one guest review and one privileged role review.
2. Set owners. Reviews fail when groups have no owners, so assign owners first.
3. Write the instructions. Tell reviewers what they are deciding and what happens if they say no.
4. Run without auto-apply, collect feedback and adjust.
5. Enable auto-apply for the reviews with clear owners and low risk of breaking business processes.
6. Report. Keep the completion rate and the number of removals, which are useful evidence for auditors and for your own security reviews.

Pitfalls

Reviews built on stale groups are noise. Nested groups can hide who really has access. Dynamic groups change membership by rule, so review the rule instead of the members. Reviews do not replace good joiner, mover and leaver processes; they catch what those processes miss.

Example reviews that pay off quickly

A guest review is usually the first win. Create a recurring quarterly review of all guest users, ask their sponsors or the group owners to confirm each one, and set the default for no response to remove access after a grace period. Next, review membership of any group that grants access to finance, HR or customer data, using the group owners as reviewers. Finally, review privileged role assignments with a named security reviewer. Each of these answers a question that auditors and customers ask: who outside our company can reach our data, who inside it can see sensitive areas, and who can change our tenant. Keep the review results, because the history of decisions is evidence that the control operates.

Making reviewers succeed

Reviewers often ignore reviews because the request looks like spam. Send a short message from a person they know before the first review, explain what they will see, and give them a contact for questions. Keep the list short, group decisions by project, and use the recommendations from sign-in activity to speed them up. Report the completion rate to managers, because visible accountability is the strongest nudge. If a review is overdue, escalate to a fallback reviewer instead of letting it expire unanswered.

Related controls

Access reviews work best with entitlement management, which controls how access is requested and when it expires, and with PIM, which controls privileged roles. They are not a substitute for removing access when someone leaves. Connect the review process to your leaver checklist, and use reviews as the safety net that catches what the checklist misses.

Microsoft references

• What are access reviews?, reviewed 5 November 2026.
• Microsoft Entra licensing, including the access reviews section, reviewed 5 November 2026.

This article was first published on 15 October 2020. It was rewritten on 5 November 2026 with current product names and licensing. Microsoft's live documentation takes precedence if it has changed.