An access review is an identity-governance process for auditing and recertifying access. It reduces the risk of identities retaining access they no longer need, especially after team or department changes or when access is privileged or critical. section 2.6.3 section 2.14
Reviews can cover Azure resource roles, Azure AD roles, Azure AD group memberships, Azure AD-integrated applications, and access packages. A designated reviewer decides whether each identity should keep or lose access; a workload owner commonly fills that role. section 2.6.3 section 2.6.3
Create a recurring review for Azure resource roles through Identity Governance and Privileged Identity Management:
- Open Identity Governance in the Azure portal, choose Azure Resources under Privileged Identity Management, select the relevant subscription, then choose Access Reviews and New. section 2.6.3
- Provide a clear name and description, because reviewers see both when performing the review. section 2.6.3
- Set a start date, a frequency—one time, weekly, monthly, quarterly, semi-annually, or annually—and the maximum review duration. section 2.6.3
- Choose how a recurring review ends: never or at a specified date. section 2.6.3
Reviewing privileged access continuously
Use Privileged Identity Management to grant privileged access on demand, then use access reviews to reassess identities that hold active or permanent privileged assignments. This adds ongoing review after privilege has been granted rather than treating activation as the final control. section 2.6.2 section 2.14
