Plan and Automate Identity Governance · Topic 2 of 4
Access Reviews
SC-300 access reviews: scope, reviewers, recurrence, non response actions, guests, reminders, auto apply and groups synchronized from on premises.
- 5 min
- Reviews cover groups, apps, roles, access packages, guests and inactive users.
- Reviewers can be owners, selected users, managers (with fallback) or the users themselves.
- Non response options: No change, Remove access, Approve access, Take recommendations.
What it is
People collect access over time, and access that is no longer needed is a risk. Access reviews ask the right people to confirm regularly who still needs access, and they can remove access that is not confirmed. This prevents access creep, where permissions pile up as people change roles.
Access reviews need Microsoft Entra ID Governance, or Entra ID P2.
How it works
What can be reviewed
| Scope | Example |
|---|---|
| Groups and Teams | Members of a sensitive security group, or guests in a Teams team |
| Applications | Users and groups assigned to an enterprise application |
| Azure resource and Entra roles | Eligible and active role assignments, through Privileged Identity Management |
| Access packages | People who hold an entitlement management package |
| Guest users | Guests in Microsoft 365 groups |
| Inactive users | Users with no sign in activity for a chosen number of days |
Who reviews
| Reviewer | When it fits |
|---|---|
| Group or resource owners | The owners know who needs the access |
| Selected users or groups | A named group of reviewers |
| Managers of users | The manager knows their team. Add fallback reviewers in case a user has no manager |
| Users review their own access | Self review, useful for guests who have no manager |
Review settings
- Recurrence. One time, or weekly, monthly, quarterly or yearly, with a duration, for example three weeks.
- Mail notifications. Announce the start and end of the review to reviewers.
- Reminders. Automatically email reviewers who have not responded partway through the review.
- Require reason on approval. The reviewer must give a justification.
- Show recommendations. The system suggests approve or deny, based on factors such as when the user last signed in.
- Multi stage reviews. For example the manager reviews first, then the resource owner.
- Auto apply results to resource. Applies the decisions when the review ends. If it is off, an administrator applies them manually.
If reviewers don't respond
This setting decides what happens to users who were not reviewed in time. It does not affect users who were reviewed.
| Option | Result |
|---|---|
| No change | Leaves access unchanged |
| Remove access | Removes access for those not reviewed |
| Approve access | Approves access for those not reviewed |
| Take recommendations | Follows the system's approve or deny recommendation |
Take care. If the setting is Remove access or Take recommendations, and auto apply is on, then all access could be removed if the reviewers do not respond.
Reviewing guest users
For reviews scoped to guests only, there is an extra setting for denied guest users. The common choice is to block the guest from signing in for 30 days, then remove them from the tenant, instead of only removing them from the group. For guests who have no manager, set the reviewers to Users review their own access, and set non response to Remove access, so guests who do not confirm are removed.
Applying results and a known limit
When a review finishes, results are applied if auto apply is on, or an administrator selects Apply. A review can only change access that Entra ID manages. For a security group synchronised from on premises Active Directory, the review cannot write membership changes back to AD, so applying denied results fails. In that case remove the denied users from the group in on premises Active Directory. A group that must stay an AD group cannot simply be converted to a Microsoft 365 group.
Monitoring a review
- The review's Results show each decision.
- The audit logs and the access reviews overview show progress and who has not responded.
- A reviewer who did not respond can be followed up using reminders, or an administrator can manually respond on their behalf in some cases.
Roles
To create reviews, a person needs a role such as Identity Governance Administrator, User Administrator or, for role reviews, Privileged Role Administrator. Reviewers do not need any admin role, and review through the My Access portal.
Choosing the setting
| The need | Setting |
|---|---|
| Reviewers forget to respond | Reminders |
| Guests have no manager | Reviewers set to users reviewing their own access |
| Unreviewed guests must lose access | If reviewers don't respond, Remove access |
| Denied guests should be cleaned up | Block sign in for 30 days, then delete |
| Review a group synced from on premises AD | Apply decisions in on premises AD, the review cannot write back |
| Find stale accounts | A review of inactive users |
A worked scenario
A company reviews its Partner-Collab group each quarter. The guests have no manager attribute, so the reviewers are set to users reviewing their own access, and the setting for non responders is Remove access. Denied guests are blocked from signing in for 30 days and then deleted. Reminders go out halfway through the three week review. Separately, a monthly review of an AD synced security group fails to apply, so the team removes the denied users in on premises Active Directory.
What to remember for the exam
- Reviews cover groups, apps, roles, access packages, guests and inactive users.
- Reviewers can be owners, selected users, managers (with fallback) or the users themselves.
- Non response options: No change, Remove access, Approve access, Take recommendations.
- Reminders send follow up emails. Mail notifications announce the start and end.
- Reviews cannot apply changes to groups synchronised from on premises AD.
Remove access or Take recommendations, combined with auto apply, can remove everyone if reviewers stay silent.
How the exam asks about this
- "Which setting emails reviewers who have not responded?" Reminders.
- "Guests with no manager must confirm their own need." Users review their own access.
- "Denied users remain in a synced group and the apply fails." Remove them in on premises Active Directory.
- "Which role can create reviews of Entra roles?" Privileged Role Administrator.
Common mistakes
Confusing reminders with mail notifications. Reminders chase non responders.
Using manager review for guests. Guests have no manager attribute.
Expecting the review to edit AD synced groups. It cannot write back.
Forgetting what non response does. It can silently remove access.
Check yourself
What does the Reminders setting do?
It automatically emails reviewers who have not responded partway through the review.
Which non response option follows the system's suggestion?
Take recommendations.
Why does applying a review fail for an on premises synced group?
Access reviews cannot write membership changes back to on premises Active Directory.
Topic 2 of 4 in Plan and Automate Identity Governance
Test yourself on Plan and Automate Identity Governance
The full Microsoft SC-300 question bank has 650 questions, with timed practice exams and an explanation for every answer.
This study guide is independent and is not affiliated with, endorsed by, or sponsored by Microsoft. Vendor names, certification names and exam codes are trademarks of their respective owners and are used for identification only.