An Azure AD access review is a formal check of who still needs access to users, groups, applications, and resources. In practice, it verifies that entitlements remain appropriate after role changes, departures, or shifts in business need, and it supports both security governance and audit readiness.
Expanded Definition
Azure AD access review is an entitlement validation process for Microsoft Entra ID, formerly Azure AD. It asks whether a user, guest, group member, or assigned application permission still matches current business need, not whether the access was once justified.
That distinction matters because access reviews are periodic governance checks, while authentication and conditional access are runtime controls. A review may confirm that a person changed teams, a guest has gone inactive, or an app no longer needs a role assignment. In mature environments, the review also covers owners, approvers, and evidence retention so the organisation can explain why access was kept or removed.
Definitions are largely consistent across Microsoft documentation and practitioner usage, but the operational boundary is often misunderstood: an access review is not a substitute for least privilege design, and it does not automatically fix bad role design or hidden privilege inheritance.
Examples and Use Cases
Access reviews show up wherever organisations need recurring proof that entitlements still match current need. They are especially common when identity sprawl, guest access, and delegated application permissions make manual oversight unreliable.
- A manager reviews whether a departed employee’s remaining group memberships should be removed after an internal transfer.
- An application owner confirms whether a service team still needs access to a production SaaS resource after a project ends.
- An external guest is re-evaluated before their collaboration period is extended, reducing stale sharing risk.
- A security team runs quarterly reviews on privileged roles to verify that elevated access has an active business owner.
- An audit team uses the review history as evidence that access decisions were checked and documented.
The tradeoff is administrative overhead versus control confidence. More frequent reviews can catch stale access earlier, but they also create review fatigue if role design is noisy or ownership is unclear. For identity programs that include non-human accounts, the same governance logic applies to machine access paths, because stale entitlement is still stale entitlement. NHIMG notes that only 5.7% of organisations have full visibility into their service accounts, which helps explain why access validation matters beyond human users alone.
Security Implications
When access reviews are weak, organisations accumulate dormant, excessive, or misassigned permissions that outlive the original justification. The result is not just clutter in an admin portal; it is a durable trust problem that expands blast radius when an account is misused, compromised, or never deprovisioned.
Common failure modes include reviewers approving access by default, owners lacking context for the entitlement being reviewed, and review scopes that omit high-risk groups or application roles. In practice, this can leave stale guest access, over-broad role membership, and unchallenged privileged access in place long after the business need has disappeared.
NHIMG reports that 97% of NHIs carry excessive privileges, increasing unauthorised access and broadening the attack surface. That statistic is relevant here because entitlement review failures often affect the same control pattern: access persists because no one has a reliable, recurring challenge process to question it.
The observable symptom is usually not a dramatic outage. It is a slow drift in access posture, where the directory still looks normal even as the actual trust boundary becomes less defensible.
Domain and Governance Relevance
Azure AD access review sits at the centre of identity governance because it turns access from a one-time grant into a recurring decision. That matters in environments with frequent role changes, contractors, guests, and application sprawl, where manual cleanup does not scale well.
In NHI-heavy environments, the same logic extends to service principals, workload permissions, API-facing integrations, and other machine access paths. A review process that only covers employees leaves a governance gap, because the highest-risk entitlements may belong to automated systems that never leave the company but often outlive the project that created them.
For this reason, access review should be treated as an evidence-producing governance control, not a ceremonial checkbox. Its value comes from forcing ownership, timing, and justification to remain visible as identities and permissions change over time.
When access reviews are tied to clear resource owners and defined review intervals, they support both security and audit readiness without turning entitlement governance into a one-off cleanup exercise.
Standards & Framework Alignment
This section maps relevant standards and security frameworks to the operational risks and controls described in this guidance.
OWASP Non-Human Identity Top 10 address the attack and risk surface, while CIS Controls v8, NIST CSF 2.0 and NIST Zero Trust (SP 800-207) set the governance and control requirements practitioners need to meet.
| Framework | Control / Reference | Relevance |
|---|---|---|
| CIS Controls v8 | 5.1 — Account Inventory and Control | Access reviews validate whether accounts and entitlements still need to exist. |
| 6.3 — Access Control Management | Azure AD access review is a direct entitlement governance practice. | |
| Recommendation — Review active access regularly and remove accounts or entitlements that no longer have a valid need. Use recurring access reviews to enforce least privilege and keep approvals tied to business need. | ||
| NIST CSF 2.0 | PR.AA-01 — Identity and Credential Lifecycle | Reviews support ongoing validation of identity access throughout its lifecycle. |
| PR.AA-05 — Access Permissions Management | The term is fundamentally about checking and correcting permissions. | |
| Recommendation — Validate that access remains appropriate as identities change roles, status, or ownership. Periodically attest permissions and revoke access that no longer matches current authorization. | ||
| NIST Zero Trust (SP 800-207) | Policy Enforcement — Policy Enforcement | Access review helps keep trust decisions aligned with policy over time. |
| Recommendation — Reassess entitlement decisions so policy enforcement reflects current risk and role context. | ||
| OWASP Non-Human Identity Top 10 | NHI-01 — Inventory and Visibility | Access reviews expose hidden or stale machine access that must be inventoried. |
| NHI-02 — Secrets and Credential Management | Reviewing access often reveals overexposed machine credentials and unmanaged trust paths. | |
| Recommendation — Inventory non-human access paths and verify each one has a current owner and purpose. Check machine-identity entitlements alongside credentials so stale access can be revoked cleanly. | ||
Related resources from NHI Mgmt Group
- How should security teams use Azure AD automation without weakening access governance?
- Why do Azure AD conditional access policies fail in practice?
- How should security teams prioritize Azure AD administrative roles for access reviews?
- What is the difference between limited access and global administrator roles in Azure AD?
