Microsoft Entra ID access reviews are the operational control that keeps your tenant from drifting between annual audits. As Microsoft Learn describes them: "Microsoft Entra access reviews enable organizations to efficiently manage group memberships, access to enterprise applications, and role assignments." (learn.microsoft.com — access-reviews-overview, accessed 23 May 2026). The February 2026 GA of machine-learning reviewer recommendations is the most consequential update in years — it cuts reviewer fatigue, the leading cause of rubber-stamped reviews.
This how-to is part of the Entra ID audit pillar. Run the free Entra ID & Identity Assessment first to find which scopes need the most attention.
Four review scopes to design
- Privileged Entra ID roles. Quarterly review of every active and eligible PIM assignment. ML recommendations surface assignments never activated in the period — strong signal for removal.
- Microsoft 365 group membership. Annual review for general groups, quarterly for groups granting access to sensitive SharePoint sites.
- Guest users. Quarterly review at a minimum. Pair with guest expiry so unreviewed accounts auto-disable. ML recommendations surface guests with no recent sign-in.
- Enterprise application assignments. Annual for low-risk apps, quarterly for apps holding personal information or financial data.
Configuration walkthrough — privileged-role access review
In Entra admin centre → Identity Governance → Access reviews → New access review:
- Type: Microsoft Entra roles.
- Roles in scope: Global Administrator, Privileged Role Administrator, Conditional Access Administrator, Security Administrator, User Administrator, Authentication Administrator, Privileged Authentication Administrator, Exchange Administrator, SharePoint Administrator. Add custom roles your organisation uses.
- Scope: All eligible and active assignments.
- Reviewers: Role owner (selected user). Avoid self-review for privileged roles.
- Duration: 14 days.
- Recurrence: Quarterly.
- Settings → Auto apply results: On. This is the most-skipped setting; without it, decisions are not enforced.
- Settings → If reviewers don't respond: Remove access. This forces the reviewer to actively keep someone in the role.
- Settings → Show reviewers recommendations: On. Enables the 2026 ML feature.
- Settings → Justification required: On.
- Notifications: Email reviewers on assignment and 3 days before close.
Configuration walkthrough — guest access review
- Type: Teams + Groups or specific groups.
- Scope: Guest users only (toggle).
- Reviewers: Group owner; for membership in groups without owners, designate the IT manager.
- Auto-apply: On.
- Recurrence: Quarterly.
- If reviewers don't respond: Take recommendations (this uses the ML signal, defaulting to remove for stale guests).
Pair with a tenant-level guest expiry policy so unused guests time out at 90 days regardless of review outcome.
Why "if reviewers don't respond" matters
The single most common reason access reviews fail is no response. The default behaviour ("no change") undermines the purpose of the control. Configure the policy to either remove access or take ML recommendations. Reviewers will quickly notice that their inattention has consequences and start engaging with the review.
Reviewer fatigue and the ML recommendations feature
Microsoft's ML recommendation engine, GA February 2026, evaluates:
- Activation frequency (for PIM roles).
- Sign-in recency (for guests).
- Group inheritance and nesting.
- Risk signals from Identity Protection.
The recommendation appears next to each user in the review pane. Reviewers can accept the recommendation with a single click. We measure a 60% reduction in time-to-complete in reviews using the feature compared to manual.
Evidence retention for OAIC enquiries
Every access review decision is retained in the Entra audit log. Export reviews quarterly and store with your assurance evidence. Retain for at least seven years, in line with the Privacy Act and most state-level record-keeping obligations. If an OAIC enquiry asks how you discharge the APP 11 "reasonable steps" obligation, the access review record is the artefact you produce.
Pitfalls to avoid
- Self-review for privileged roles. Permitted by the platform; undermines audit defensibility. Use role owner instead.
- Annual cadence for privileged roles. Quarterly is the minimum the ASD ISM expects in practice.
- Auto-apply off. The decisions don't take effect. We have audited tenants where every review showed "complete" but no permissions had changed.
- No notification on assignment. Reviewers miss the email. Configure both an assignment email and a 3-day reminder.
Bottom line
Four scopes, quarterly cadence on the two that matter most, auto-apply on, ML recommendations on. That is the defensible Entra ID access review programme for an Australian organisation. The free Entra ID & Identity Assessment measures whether you have it; the practitioner Identity and Access Review inspects the configuration and evidence.
Sources: Microsoft Learn — Access Reviews overview and reviewer recommendations (accessed 23 May 2026). ASD Information Security Manual November 2025 release (cyber.gov.au, accessed 23 May 2026). OAIC Notifiable Data Breaches scheme — Australian Privacy Principle 11 reasonable-steps guidance (oaic.gov.au, accessed 23 May 2026).
