How to Create an Access Review in Microsoft Entra ID Governance

Access reviews make the people who know best confirm who should keep access to a group or application. This guide follows Microsoft Learn’s steps for creating a single-stage or multi-stage review.

Before you start

• Licence: Microsoft Entra ID Governance or Microsoft Entra Suite. Microsoft links a licensing article to help pick the right one; its page doesn’t say which SKU includes which feature.
• Role: at least Identity Governance Administrator. For Teams with shared channels, User Administrator or Identity Governance Administrator.
• Applications: confirm the app is integrated with Entra ID in your tenant first.
• Group owners creating reviews (optional): an Identity Governance Administrator must set ID Governance > Access Reviews > Settings > Group owners can create and manage access reviews for groups they own to Yes. The default is No.

Create a single-stage review

1. Sign in to the Microsoft Entra admin center.
2. Go to ID Governance > Access Reviews and select New access review.
3. Select Review access to a resource type.
4. Select what to review: Teams + Groups (all Microsoft 365 groups with guest users, or a chosen list) or Applications. Selecting several resources creates one review per resource.
5. Set the scope: guest users only or everyone. Optionally review only inactive users (up to 730 days inactive) for group membership reviews.
6. Choose reviewers: group owners, selected users or groups, users reviewing their own access, or managers of users. Add fallback reviewers for owners or managers where needed.
7. Set recurrence: duration in days, start date, and an end of Never, a specific date or a number of occurrences.

Completion settings

• Auto apply results to resource: if on, denied access is removed automatically when the review ends. If off, you apply results manually.
• If reviewers don’t respond: No change, Remove access, Approve access or Take recommendations.
• Denied guest users (guest-only scope): remove membership, or block sign-in for 30 days and then remove from the tenant.
• Notifications: add people to receive completion updates.

Decision helpers and advanced settings

• No sign-in within 30 days: recommends denial for users who haven’t signed in.
• User-to-Group Affiliation: recommends based on distance in the reporting structure.
• Advanced: require justification, email notifications, midpoint reminders and extra text in reviewer emails.

Finish with Next: Review + Create, enter a required name and optional description, and select Create.

Multi-stage reviews

On the Reviews tab choose Multi-stage review. Two stages are the default, with a third via + Add a stage. Each stage has its own reviewers and duration. Recurrence must be at least the sum of stage durations. Choose who advances (Approved, Denied, Not reviewed, Don’t know or All), and decide whether later reviewers see earlier decisions; leaving it cleared keeps decisions independent.

Pitfalls Microsoft calls out

• Risky combination: if non-response is Remove access or Take recommendations and auto-apply is on, unresponsive reviewers could cause all access to be revoked.
• Snapshots: each recurrence captures users, resources and reviewers at its start. Mid-review changes apply to the next cycle.
• Guest reviewers get no email until they accept the tenant invitation.
• Start time can slip by a few hours.
• Nested groups are flattened; removing a user removes only direct membership.
• Restricted management administrative units can’t be managed with access reviews.

Quick checklist

• Licence and role confirmed
• Right scope and reviewers, with fallbacks
• Non-response action reviewed against auto-apply
• Notifications on, or reviewers told manually

Sources

• Create an access review of groups and applications – Microsoft Learn