5.2. Access Reviews
💡 First Principle: Access decays: people change roles, projects end, guests go quiet — but permissions persist until someone re-asks the question. Access reviews institutionalize the re-asking: on a schedule, a named reviewer attests keep or remove per user, and the system applies the verdict. Attestation without automation is theater; the apply step is what makes reviews governance.
What can be reviewed: group memberships (security and M365 — including guest-only scopes), application assignments, access package assignments (from 5.1), and privileged role assignments (PIM's flavor, 5.3.3). Reviewers can be the users themselves (self-attestation), their managers, selected reviewers, or — for groups — group owners. Multi-stage reviews chain reviewers (manager first, then resource owner) to spread accountability. Scheduling is one-time or recurring (weekly through annually), each recurrence a bounded window.
The settings that decide exam answers live in Upon completion and helper sections. Auto-apply results: on = removals execute when the review closes; off = results sit until an admin applies them manually — the default-behavior trap. If reviewers don't respond: no change / remove access / approve access / take recommendations. Recommendations bring signal into the click: flag users inactive over 30 days, and (for guests) surface last sign-in, so a reviewer facing 400 rows can accept recommendations wholesale. Require reason on approval forces justification where compliance demands it.
The classic patterns to recognize: quarterly guest cleanup — recurring review of guest users' group/team memberships, reviewer = group owner or sponsor, no-response = remove, auto-apply on; app recertification — semi-annual review of an app's assignments by the app owner; self-attestation for broad low-risk groups. Reviews of review-worthy scope beat reviewing everything: prioritize guests, privileged roles, and sensitive apps.
⚠️ Exam Trap: A review whose results were never applied changes nothing — and with auto-apply off, that's the out-of-box behavior. "The review completed but denied users still have access" → nobody applied results (or the no-response option was no change). Check Upon completion settings before blaming the feature.
Reflection Question: Design the review that empties your tenant of forgotten guests with zero admin clicks per cycle: scope, reviewer, recurrence, no-response behavior, helper setting, and the one switch that makes it self-executing — then say which of those choices you'd change for a review of Global Administrator assignments.
