Domain 4 of 4 · Chapter 2 of 4

Access Reviews

Unlock the complete study guide + 1,040 practice questions across 16 full exams.

Bundled into the existing Microsoft Certified: Identity and Access Administrator Associate premium course — no separate purchase.

Included in this chapter:

  • What an access review is, and where it lives
  • Configuring a review: scope, reviewers, recurrence
  • Completion settings: what happens to access, and the auto-apply trap
  • Monitoring a review and responding to it manually

Access review resource types: where you create each and who can review

Resource under reviewCreated inEligible reviewersReviewer experience
Security / Microsoft 365 group membershipID Governance > Access Reviews (or group owners, if delegated)Group owner(s), selected users/groups, managers, self-reviewMy Access portal
Access to a connected enterprise applicationID Governance > Access Reviews / Enterprise appsSelected users/groups, managers, self-reviewMy Access portal
Microsoft Entra role assignmentPrivileged Identity Management (PIM)Selected reviewers, self-reviewMicrosoft Entra admin center
Azure resource role assignmentPrivileged Identity Management (PIM)Selected reviewers, self-reviewMicrosoft Entra admin center
Access package assignmentEntitlement managementSelected reviewers, group members, self-reviewMy Access portal

Decision tree

What do you review?pick the creation surfaceGroup / app accessAccess Reviews bladeEntra / Azure rolecreate in PIMAccess packageentitlement mgmtgroups, appsrolespackagesWho reviews?match accountabilityOwner / manageradd a fallback reviewerDesignated userselected reviewer(s)Self-reviewweak signal: attestationaccountable ownerno ownerNo reviewer responds?set the default decisionNo change + manual Applysafe: nothing removed silentlyRemove access + auto-applyaggressive: cleans dormantover-keepover-remove
Cheat sheet

Cheat sheet

  • Access reviews recertify access that already exists, they don't grant it
  • Access reviews require an Entra ID Governance license, not just P2
  • What you review decides where you create it
  • A PIM role review recertifies standing assignments; PIM activation approves elevation in real time
  • Pick the reviewer to match accountability: owner, manager, designated user, or self
  • Self-review is the weakest reviewer choice
  • Group owners can't run their own reviews until an admin delegates it
  • Fallback reviewers cover users with no manager or groups with no owner
  • Scope a review to inactive users with a Days inactive threshold up to 730
  • Decision helpers recommend Deny for inactive users and peer outliers
  • Auto apply removes denied users automatically; without it an admin must click Apply
  • If reviewers don't respond sets the default for un-reviewed users only
  • Remove access plus auto-apply can strip everyone if reviewers go silent
  • Denied guests: remove membership, or block 30 days then delete
  • A reviewer's Deny doesn't remove access until the review is applied
  • Don't know keeps access and is recorded in the audit log
  • Monitor a review through Completed, Applying, Result applied
  • Apply can't change on-prem-synced, dynamic, or nested-group membership
  • Multi-stage reviews chain two or three reviewer sets, later stage overwrites
  • Recurring reviews re-snapshot membership each instance
  • Use Review History to produce a downloadable report of reviewer decisions across reviews
  • Changes to a recurring review apply to the current instance or the whole series depending on where you edit
  • Block-and-remove for denied guests requires the Select Teams + groups scope, not All M365 groups

Unlock with Premium — includes all practice exams and the complete study guide.

Also tested in

References

  1. What are access reviews?
  2. Create an access review of Microsoft Entra roles in PIM