A denied decision doesn’t always remove the underlying permission. These reviews help identify unnecessary group memberships, application assignments and privileged access, but removal depends on the resource type, review settings and how access was originally granted.
Start by identifying those access paths, then configure reviewers, recurrence and enforcement. The useful outcome is confirmed removal, supported by evidence, rather than a completed review with outstanding changes.
Key Takeaways
- Microsoft 365 access reviews check whether people still need access to groups, applications and privileged roles. They don’t replace joiner, mover and leaver procedures or sign-in controls.
- Check access paths beyond group membership, including direct SharePoint permissions, shared links, Teams shared channels and mailbox delegation.
- A denied decision doesn’t prove that access has been removed. Apply results where supported, check the status and record completed changes or assigned remediation.
- Choose reviewers with the right business context, set suitable review dates and recurrence, and pilot removal before enabling automatic application.
- Include active and eligible privileged role assignments in reviews, and retain decisions, justifications and remediation evidence.
Define what Microsoft 365 access reviews will cover
Separate permissions from sign-in controls
An access review is a periodic check of whether someone still needs access. Reviewers decide whether user access to scoped resources should continue.
These checks help prevent privilege creep, where permissions accumulate after role changes, temporary projects and supplier engagements. They support least privilege and compliance, but don’t replace joiner, mover and leaver procedures.
Conditional Access addresses a different question: under what conditions an account may sign in. A successful sign-in doesn’t prove that existing access permissions are still appropriate.
Identify access paths before selecting resources
Inventory sensitive Teams, groups, enterprise applications and administrative roles. Record resource owners and group owners, the business purpose, membership source and whether external guests have access.
Group membership is only part of the picture. SharePoint direct permissions, Anyone links, Teams shared channels and mailbox delegation may need separate checks.
Our Office 365 assessment covers wider configuration and permission issues a group-focused review may miss. Check licensing against the review scope; Microsoft Entra ID Governance features depend on your subscription.
Configure reviews in Microsoft Entra
Select resources and accountable reviewers
For standard group and application access reviews in Microsoft Entra ID, use an account with at least the User Administrator role. Follow Microsoft’s access review configuration guidance and begin with a limited pilot.
- Sign in to the Microsoft Entra admin center.
- Open Identity Governance, then start a new review.
- Select Teams + Groups or Applications, then choose the resources and users within scope.
- Select Next: Reviews and assign the reviewers.
Choose reviewers who understand the business need, rather than whoever receives the fewest notifications. Group owners can assess collaboration access; application owners may be better placed to assess specialist systems.
Provide a fallback reviewer in case the selected person is absent or unavailable. A self-review can gather information, but a user’s own decision to approve or deny sensitive access is weak evidence.
Set stages, duration and recurrence
A single-stage review lets assigned people make decisions within one stage. A multi-stage review uses two or three sequential stages with different reviewer groups.
Use a multi-stage review when a decision needs different perspectives, such as business justification followed by application-owner approval. Extra stages extend the process and increase workload.
Set Stage duration in days. When it ends, reviewees move to the next configured action or stage. Set the start date and Review recurrence, such as monthly or yearly, according to the resource’s sensitivity and rate of change. Schedule a review around quarter end when that fits the resource’s risk or reporting cycle.
Set what happens when reviewers do not respond
For access reviews, the non-response setting determines what happens when an item remains undecided. It doesn’t prove that access permissions have been removed. Applying results is a separate step, and removal depends on whether the resource supports the change.
Use these settings together rather than treating each as an independent safeguard.
| Setting | Effect | Practical consideration |
|---|---|---|
| Auto apply results to resource | Applies decisions after the review expires, including removal of denied access where supported. | Pilot removal before using it across sensitive resources. |
| No change | Leaves unanswered access unchanged. | Escalate outstanding decisions rather than recording them as approved. |
| Remove access | Treats unanswered items as removal decisions. | Allow for reviewer absence and business-critical access. |
| Approve access | Approves unanswered items. | Silence doesn’t establish a continuing business need. |
| Take recommendations | Uses system recommendations for unanswered items. | Understand which signals produced the recommendation. |
The No sign-in within 30 days recommendation favours approval for users who signed in within that period and denial for those who didn’t.
Recent activity is evidence of use, not proof of need. An employee can use a system regularly while retaining permissions beyond their current responsibilities.
Enable email notifications and reminders, and require a decision justification where appropriate. During a pilot, apply results manually so administrators can inspect proposed removals before enabling automatic enforcement.
Use catalog reviews for related resources
Bring multiple resource types into scope
A catalog access review requires Microsoft Entra ID Governance or Microsoft Entra Suite subscriptions. Creating one requires at least the Identity Governance Administrator role, so don’t assume the role used for a standard group review is sufficient.
A catalog access review can include groups, applications and custom data-provided resources. Reviewers can assess related access together instead of reviewing each resource in isolation.
Under Entitlement management, open Catalogs, select the catalog, then Resources and Add resources. Microsoft’s catalog access review documentation describes the configuration and supported resource model.
Allow for timing and enforcement differences
Changes made within 12 hours before a catalog access review starts may not appear in its results. Don’t treat last-minute membership cleanup as the baseline for a scheduled review.
Record which resources were included and when the review started. This makes later differences between review data and current membership easier to explain.
Adding resources to a catalog doesn’t guarantee that every target system can remove access automatically. Document the removal process for each resource, including who owns any outstanding action. Our cloud services and Office 365 support includes user account and access management.
Confirm that denied access is actually removed
Inspect application results and remaining access
An access review can be complete before its results are applied. If automatic application is disabled, an administrator must apply the results manually. If it’s enabled, check the application status and any failures.
Microsoft’s guidance on completing access reviews explains the application process and resource limitations. Compare denied decisions with current group memberships or application assignments.
Then check for other access paths. Removing one direct assignment may leave access through another group, a separate permission or a shared link.
For example, removing someone from a Team doesn’t disable a previously shared Anyone link. That link needs separate attention.
Handle mail-enabled security groups separately
Mail-enabled security groups can’t be managed through Microsoft Entra ID in the same way as supported cloud groups. Their membership is read-only through Microsoft Graph, so access reviews can’t automatically remove members through that route.
Changing the reviewer doesn’t resolve this management limitation. Use an Exchange-managed remediation process, assign responsibility for the change and retain evidence of the resulting membership.
Mailbox permissions also need separate attention. Full Access, Send As and forwarding settings aren’t resolved by reviewing a collaboration group. Our email security services cover account and mailbox protection alongside wider email risks.
Scale reviews without overwhelming resource owners
For hundreds of groups, organise access reviews by sensitivity, business function and accountable resource owners. Prioritise privileged access, sensitive applications and external collaboration, rather than sending every owner the entire backlog.
Reviewers need enough context to make defensible decisions: the resource’s purpose, the person’s role, recent activity and any approved exception. Long lists of names without business context encourage repeated approvals.
Stagger review schedules around quarter end and monitor completion, unanswered items and the quality of justifications. A high completion rate can conceal weak scrutiny if every decision carries the same explanation.
Keep a separate exceptions register for access that remains necessary despite an inactivity recommendation. Record the reason, approving owner and expiry date.
Access reviews also need to sit within wider account protection. Our cyber security services address access controls alongside authentication, endpoint protection and cloud security. Reviewing entitlement doesn’t prevent someone from stealing an authorised user’s session.
Retain evidence and review privileged access separately
Include active and eligible administrative roles
Document the scope and timing of privileged access reviews before quarter end. Include Global Administrator and other privileged role holders.
Include both active assignments and eligibility through Privileged Identity Management (PIM). Eligible assignments still allow activation under their configured conditions, so include them in access reviews even when the administrator is not currently active.
Microsoft provides a separate process for reviewing privileged role assignments. For each role, confirm it remains necessary, its scope is appropriate and who approved continued access.
Set the review frequency according to risk and applicable compliance obligations. Quarterly reviews are a scheduling choice, not a universal rule.
Keep decisions and remediation evidence together
Retain the review definition, resource scope, reviewers, dates, decisions, justifications and application results. Record non-responses separately from explicit approvals so reports distinguish the two.
For denied access, retain evidence of the completed change or an assigned remediation task. Document failures, exceptions and the dates they were resolved.
Set retention according to contractual, regulatory and internal requirements. Avoid choosing a period simply because an export is convenient to store.
Our explanation of Cyber Essentials cloud scope covers why Microsoft hosting the platform doesn’t remove an organisation’s responsibility for its own tenant configuration.
Frequently Asked Questions
What is a Microsoft 365 access review?
It’s a periodic check of whether someone still needs access to scoped resources. Reviewers decide whether access should continue, but a completed review doesn’t by itself confirm that permissions were removed.
Does denying access automatically remove the permission?
Only when results are applied and the resource supports the change. Check the application status and compare denied decisions with current memberships or assignments, then record any completed remediation.
What happens when a reviewer doesn’t respond?
The review’s non-response setting determines whether unanswered access stays unchanged, is removed, is approved or follows a system recommendation. Silence doesn’t establish a continuing business need, so escalate outstanding decisions where appropriate.
Can an access review remove members from a mail-enabled security group?
No. Membership is read-only through Microsoft Graph, so use an Exchange-managed remediation process and retain evidence of the change.
Should eligible privileged roles be included in access reviews?
Yes. Eligible assignments through Privileged Identity Management still allow activation under their configured conditions, even when the administrator isn’t currently active.
Make permission removal the completion point
Microsoft 365 access reviews are complete only when denied access has been removed or assigned for remediation, with evidence recorded for each access review.
Treat unresolved remediation as outstanding work, even when the review itself shows as complete.
If you need help establishing that process, our Microsoft 365 services include user management, permissions and security support. Speak to our team about reviewing access and putting a repeatable removal process in place.
