It is working when reviews catch standing privilege, dormant service principals, stale guest access, and role assignments that no longer match actual use. If the process only exports lists and closes tickets, it is producing paperwork, not governance. The useful signal is whether the review changes access state before the next change in the directory.
What “working” looks like for Entra ID access certification
access certification is only doing real governance work if reviewers are changing access, not just acknowledging it. For Entra ID, that means the review outcome should reduce standing privilege, remove stale guests, surface dormant service principals, and correct role assignments that do not match current business use. The measure is the post-review state, not the exported report.
A useful certification cycle also shows that reviewers had enough context to make a decision. If the process cannot distinguish active from inactive access, or cannot separate legitimate exceptions from obvious cleanup, it will drift toward rubber-stamping. The practical test is whether the campaign resolves access uncertainty before the next directory change.
That is why Access Reviews and Certification Guide matters here: the guide is about designing reviews that remove access, close the loop, and avoid treating certification as a paperwork exercise. For broader governance foundations, IAM and IGA Basics anchors the difference between access administration and actual access governance.
How teams tell the certification is changing access, not just producing reports
The strongest signal is whether the review changes the effective access graph. If a review ends with fewer active role assignments, fewer orphaned entitlements, or fewer dormant identities carrying access they no longer need, the campaign is working. If nothing materially changes between campaigns, the process is probably measuring participation rather than control.
Teams should also look at exception quality. A healthy certification process produces a small number of defensible exceptions with clear owners, expiration dates, or compensating controls. A weak process accumulates vague approvals, long-lived exceptions, and reviewer comments that never translate into access removal.
For Entra ID specifically, service principals and guest accounts deserve special attention because they often outlive the project, application, or vendor relationship that created them. Active Directory and Entra ID Hardening Guide is useful when you want to connect certification outcomes to the wider control plane, including privileged groups, delegation, and hybrid identity.
Common failure modes in Entra ID certification
Certification fails when it becomes a one-time export and approve workflow detached from actual usage. That usually shows up as reviewers approving access because they recognise a name, not because they verified business need. It also shows up when dormant service principals, shared admin roles, and guest access remain in place because no one owns the cleanup after approval.
Another common failure mode is role and entitlement review without evidence of activity. If the reviewer cannot see how the access was used, they are forced to make a policy judgment with too little signal. That creates either over-removal, where legitimate access is stripped, or under-removal, where unnecessary access survives every campaign.
The control breaks down further when the campaign does not reach the identities most likely to accumulate risk. NHI Lifecycle Management Guide is relevant because lifecycle gaps are often what keep stale service principals and other non-user access alive long after they should have been removed. For role cleanup logic, Role Mining and Role Design Guide helps teams avoid certifying broken role structures instead of fixing them.
Risk and Threat Considerations
When certification is ineffective, the risk is not abstract governance drift, it is persistent excess access. Standing privilege, stale guests, and unused service principals widen the blast radius of a compromised account or abused admin path, and they make it easier for attackers to find access that should have been removed long before the compromise.
Failure mechanism: Reviewers approve access without validating current need, or the workflow exports results but does not enforce removals, so excess privilege survives into the next cycle.
Impact: Unnecessary access remains available for misuse, lateral movement, and persistence, while the organisation falsely believes the control is reducing exposure.
Standards & Framework Alignment
This section maps relevant standards and security frameworks to the operational risks and controls described in this guidance.
NIST SP 800-53 Rev 5, CIS Controls v8 and NIST CSF 2.0 set the technical controls, while ISO/IEC 27001:2022 defines the regulatory obligations.
| Framework | Control / Reference | Relevance |
|---|---|---|
| NIST SP 800-53 Rev 5 | AC-2 — Account Management | Access certification validates account and entitlement necessity. |
| AC-6 — Least Privilege | Certification should reduce standing privilege and excess access. | |
| AU-6 — Audit Review, Analysis, and Reporting | Certification needs evidence of usage to support decisions and remediation. | |
| Recommendation — Review and remove unnecessary accounts and entitlements on a recurring basis. Revoke permissions that exceed current job or service needs. Use activity evidence to validate access decisions and flag stale access. | ||
| CIS Controls v8 | CIS-5 — Account Management | Certification is an account and entitlement hygiene control. |
| CIS-6 — Access Control Management | The question is about whether reviews actually change access state. | |
| Recommendation — Periodically review accounts and remove those no longer justified. Enforce least privilege and verify access changes after review completion. | ||
| NIST CSF 2.0 | PR.AA-05 — Identity Access Management | Entra ID certification is an identity governance mechanism for access decisions. |
| GV.RR-02 — Risk Response Roles, Responsibilities, and Authorities | Effective certification depends on clear ownership for review and remediation. | |
| Recommendation — Continuously review and adjust access based on current need. Assign clear authority for access review decisions and enforcement. | ||
| ISO/IEC 27001:2022 | A.5.15 — Access control | Certification is an access control review mechanism that should remove excess access. |
| Recommendation — Review access rights regularly and remove those no longer required. | ||
Practitioner Guidance
What to verify: Confirm that each campaign produces actual access changes, not just completion status. Look for removals of stale guests, dormant service principals, and role assignments that no longer map to current duties.
Decision rule: If the review cannot show pre- and post-campaign access state, treat it as an administrative workflow, not an assurance control. If it can show removals and clean exceptions, it is producing governance value.
What practitioners underestimate: The hardest part is often not the reviewer decision, but the follow-through that makes the decision real in the directory. A certification programme only earns trust when cleanup is measurable and repeatable across cycles.
Practitioner takeaway: The best test of Entra ID certification is whether it shrinks unnecessary access before the next change window, because that is what separates governance from reporting.
Related resources from NHI Mgmt Group
- How can security teams tell whether privileged access reviews are actually working?
- How can security teams tell whether JIT access is actually working in AWS?
- How can security teams tell whether a D365 BC access review is actually working?
- How can security teams tell whether initial-access detection is actually working?