L14. Access Reviews: Automated Recertification

What Are Access Reviews?

Access reviews provide a systematic way to verify that users still need their assigned access. Reviewers examine memberships and assignments on a scheduled basis and approve or deny continued access. This is a core identity governance control for compliance frameworks like SOX, ISO 27001, and SOC 2. Licensing: Entra ID P2 is required for access reviews (or Entra ID Governance add-on).

What Can Be Reviewed?

Creating an Access Review

Key configuration parameters:

Reviewers

• Self-review: Users review their own access (least reliable)
• Group owners: Owners review their group members
• Selected users/groups: Designated reviewers (e.g., managers, security team)
• Managers of users: Each user's direct manager reviews their access

Recurrence

• One-time, weekly, monthly, quarterly, or annually
• Start date and end date
• Duration per review cycle (how long reviewers have to respond)

Upon Completion Settings

• Auto-apply results: Automatically remove denied access when the review ends
• If reviewers don't respond: Options include No change, Remove access, Approve access, or Take recommendations

Exam tip: The "Take recommendations" option uses Entra ID intelligence to suggest approve or deny based on sign-in activity. If a user has not signed in during the review period, the recommendation is to deny access. This is the most commonly tested auto-decision setting.

Multi-Stage Reviews

Multi-stage access reviews allow different reviewers at each stage:

• Stage 1: Manager reviews their direct reports
• Stage 2: Security team reviews escalated or denied access
• Stage 3: Final approver or compliance officer

Only users approved at each stage proceed to the next. This creates a layered verification process.

Guest Access Reviews

Guest (B2B) access reviews are critical for organizations that collaborate with external partners. Recommended configuration:

• Scope: All guest users in a specific group or across the tenant
• Reviewer: Group owners or sponsoring employees
• Recurrence: Quarterly
• If no response: Remove access (guests should not retain access without active justification)

Exam tip: For guest access reviews, the recommended "no response" action is to remove access. This follows the principle that external access should be explicitly justified, not maintained by default.

Review Decisions and History

Reviewers make one of these decisions for each user:

• Approve: User retains access
• Deny: User access is removed (or queued for removal)
• Don't know: Defers to the system's recommendation or next stage

All review decisions are logged in the audit trail for compliance reporting.

Programmatic Access

Access reviews can be created and managed programmatically via Microsoft Graph API:

POST https://graph.microsoft.com/v1.0/identityGovernance/accessReviews/definitions

This enables integration with IT service management tools and automated governance workflows.