Using Microsoft Entra ID Access Reviews for Teams and Groups
Managing guest and member access in Microsoft Teams and Microsoft 365 Groups can quickly become complex, especially in larger organizations with frequent collaboration and external sharing. Microsoft Entra ID Access Reviews provide an automated and structured approach to ensuring that only authorized users retain access to Teams, groups, and shared resources. This feature is part of Microsoft Entra ID Governance and is particularly valuable for maintaining compliance, data security, and proper lifecycle management of access permissions.
Understanding Entra ID Access Reviews
An Access Review in Microsoft Entra ID allows administrators to periodically verify and validate user and guest access across Teams and Microsoft 365 Groups. Reviewers—typically group owners, managers, or administrators—can confirm whether access should be retained, revoked, or delegated for re-evaluation.
The process helps enforce least-privilege access, remove inactive or unnecessary users, and maintain audit readiness in environments that handle sensitive data.
Licensing Requirements
- Some Access Review capabilities are available under Microsoft Entra ID Premium P2.
- Full governance features, including multi-stage reviews and fallback reviewers, require a Microsoft Entra ID Governance license.
Learn more about licensing details here:
Microsoft Learn – Entra ID Governance Licensing Fundamentals
When to Use Access Reviews for Teams and Groups
Access Reviews are particularly useful for:
- Guest Access Management: Regularly verifying external users’ access to shared Teams or Groups.
- Membership Review: Confirming if internal members still require ongoing access to a specific group or project team.
- Compliance and Audit: Demonstrating active governance for industry regulations like ISO 27001 or GDPR.
- Lifecycle Management: Cleaning up inactive Teams or Groups by removing unneeded members automatically.
Organizations often schedule reviews quarterly or semi-annually to maintain a continuous governance cycle.
Step-by-Step Guide: Creating an Access Review
1. Open Access Reviews in Microsoft Entra
- Sign in to the Azure Portal at https://portal.azure.com,
or open the Microsoft Entra Admin Center at https://entra.microsoft.com. - Navigate to:
Identity Governance → Access Reviews → New Access Review.
You’ll see the Access Reviews dashboard where you can define your review’s scope and settings.
2. Define Review Scope
Choose Teams + Groups as the target for the review.
You can:
- Select All Microsoft 365 Groups with guest users, or
- Choose Specific Teams and Groups that you want to include.
For example, you might review all Teams with guest members every six months, ensuring external collaborators lose access once projects end.
3. Choose Users to Review
Select whether the review applies to:
- Guest users only, or
- All users in the selected Teams or Groups.
This setting defines the population under review.
In environments with a large external footprint, focusing on guest users is often best practice.
4. Configure Review Stages and Reviewers
Click Next: Reviews to set up the structure of your review.
You can choose between:
- Single-Stage Review: One round of approval.
- Multi-Stage Review: Up to three consecutive review levels.
Each stage can have different reviewers, adding flexibility for multi-level governance (for example, team owner → department manager → compliance officer).
Reviewer Options:
- Group Owner(s) – Automatically selected owners of the Teams or groups.
- Selected User(s) or Group(s) – Manually designate specific individuals or security groups as reviewers.
- Users Review Their Own Access – Ideal for user-driven self-attestation.
- Managers of Users – Uses Entra’s organizational hierarchy to route review tasks to each user’s manager.
You can also add a fallback reviewer, such as an administrator, in case a group has no owner.
5. Set Review Frequency and Duration
Next, define how often the review runs and how long it remains active.
- Duration: Set how many days reviewers have to complete their tasks (e.g., 7, 14, or 30 days).
- Recurrence: Choose between one-time or recurring reviews (monthly, quarterly, semi-annually, or annually).
For example, you might configure a 7-day review period that repeats every six months, automatically assigned to group owners.
6. Configure Review Settings
Click Next: Settings to manage advanced options:
- Upon completion:
- Remove access automatically – Revokes membership for users marked “Deny” or “No Response.”
- Keep access by default – Retains access unless explicitly denied.
- Recommendations:
Enable recommendations based on user activity. Inactive users can automatically be suggested for removal. - Notification Settings:
Decide whether reviewers and administrators receive email reminders during and after the review.
This automation reduces manual follow-up and ensures consistent enforcement of access decisions.
7. Review and Create
Finally, select Next: Review + Create.
Provide a clear name and description for the access review (e.g., “Quarterly Guest Access Review for Marketing Teams”).
Click Create to initiate the process.
Once created, each selected Team or Group will appear as an individual review item within the Access Reviews dashboard. This makes it easy to monitor completion status and compliance results.
Monitoring and Completing Reviews
When a review starts:
- Reviewers receive an email notification with a link to the review page.
- The email directs them to the Access Reviews portal in Entra, where they can approve, deny, or skip each user.
Reviewer Options:
- Approve: User retains access.
- Deny: User access is revoked after review completion.
- Don’t Know: Reviewer skips the decision (may trigger fallback reviewer).
- Accept Recommendations: Reviewer agrees with system suggestions based on user activity.
Administrators can track review progress and completion through the Access Reviews dashboard, with metrics on reviewer participation and decision outcomes.
Post-Review Actions
When the review period ends:
- If automatic removal is enabled: Users marked as “Deny” or “Inactive” are removed from Teams or Groups.
- If manual completion is required: An admin can review results, make adjustments, and apply changes manually.
All actions are logged for auditing and compliance purposes. Review outcomes can also be exported for reporting or integrated into your organization’s compliance framework.
Best Practices for Managing Access Reviews
- Start Small: Begin with guest access reviews for sensitive Teams before expanding organization-wide.
- Enable Recommendations: Use activity-based insights to identify inactive users.
- Leverage Recurring Reviews: Schedule semi-annual or quarterly reviews for continuous compliance.
- Delegate to Group Owners: Empower owners to make access decisions for their teams.
- Monitor Completion Rates: Track reviewer participation to ensure accountability.
- Combine with Conditional Access: Strengthen governance by pairing access reviews with Conditional Access policies.
Summary
Microsoft Entra ID Access Reviews provide a powerful mechanism for maintaining clean, secure, and compliant access across Teams and Groups. By automating periodic reviews, organizations can reduce the risk of over-privileged users, ensure guests are removed when no longer needed, and meet governance requirements efficiently.
With flexible review configurations, multiple reviewer roles, and automated enforcement, Entra Access Reviews form a cornerstone of modern identity governance in Microsoft 365 environments.
