Microsoft Entra access reviews
Use Microsoft Entra access reviews to configure one-time or recurring access reviews for attestation of a principal's right to access Microsoft Entra resources. The principals are users or applications (service principals). The Microsoft Entra resources include groups, applications (service principals), access packages, and privileged roles. Access reviews is a feature of Microsoft Entra ID Governance.
Typical customer scenarios for access reviews include:
- Customers can review and certify guest user access to groups through group memberships. Reviewers can use the insights that are provided to efficiently decide whether guests should have continued access.
- Customers can review and certify employee access to Microsoft Entra resources.
- Customers can review and audit assignments to Microsoft Entra ID privileged roles. This supports organizations in the management of privileged access.
The tenant where an access review is being created or managed via the API must have sufficient purchased or trial licenses. For more information about the license requirements, see Access reviews license requirements.
This article describes how to export personal data from a device or service. These steps can be used to support your obligations under the General Data Protection Regulation (GDPR). Authorized tenant admins can use Microsoft Graph to correct, update, or delete identifiable information about end users, including customer and employee user profiles or personal data, such as a user's name, work title, address, or phone number, in your Microsoft Entra ID environment.
The following table lists the methods that you can use to interact with access review-related resources.
|Get a list of the accessReviewScheduleDefinition objects and their properties.
|Create a new accessReviewScheduleDefinition object.
|Read the properties and relationships of an accessReviewScheduleDefinition object.
|Update the properties of an accessReviewScheduleDefinition object.
|Deletes an accessReviewScheduleDefinition object.
|Returns all definitions where the calling user is the reviewer of any instances.
|Get a list of the accessReviewInstance objects and their properties.
|Read the properties and relationships of an accessReviewInstance object.
|Manually stop an accessReviewInstance.
|Send a reminder to the reviewers of an accessReviewInstance.
|Resets all decision items on an instance to
|Manually apply decision on an accessReviewInstance.
|Allows the calling user to accept the decision recommendation for each NotReviewed accessReviewInstanceDecisionItem that they are the reviewer on for a specific accessReviewInstance.
|Review batches of principals or resources in one call.
|Returns all instance objects on a definition for which the calling user is the reviewer.
|Instance decision items
|Get a list of the accessReviewInstanceDecisionItem objects and their properties.
|Read the properties and relationships of an accessReviewInstanceDecisionItem object.
|Update the properties of an accessReviewInstanceDecisionItem object.
|Returns the decision items for which the calling user is the reviewer of.
|Get a list of the accessReviewHistoryDefinition objects and their properties.
|Create a new accessReviewHistoryDefinition object.
|Read the properties and relationships of an accessReviewHistoryDefinition object.
|Generate a URI for an instance that can be used to retrieve review history data.
|Retrieve a list of the accessReviewHistoryInstance objects and their properties.
Role and application permission authorization checks
The following Microsoft Entra roles are required for a calling user to manage access reviews.
|Required directory role of the calling user
|AccessReview.Read.All or AccessReview.ReadWrite.All
|Global Administrator, Global Reader, Security Administrator, Security Reader or User Administrator
|Create, Update or Delete
|Global Administrator or User Administrator
In addition, a user who is an assigned reviewer of an access review can manage their decisions, without needing to be in a directory role.
- Microsoft Entra access reviews
- Tutorials to learn how to use the access reviews API to review access to Microsoft Entra resources
- How an administrator can manage user access with Microsoft Entra access reviews
- How an administrator can manage guest access with Microsoft Entra access reviews