It depends.
If you need to just do basic access reviews, then all you need is a P2 if you already have it.
If not, then you need at least a Microsoft Azure Active Directory Premium P1 or Microsoft 365 E3 plus the Goverernance license
The Access Reviews available as an add on via Entra ID Governance
- Access reviews - PIM For Groups - Public Preview
- Access reviews - Inactive Users reviews
- Access reviews - Machine learning assisted access certifications and reviews
As far as who needs to be licensed: