Permissions for Microsoft 365 groups or applications can change constantly. This makes the effort of checking permissions time-consuming and inefficient.
With the Azure Active Directory feature “Access Review”, this task can be largely automated and inactive users and guests can be removed from the Microsoft 365 groups and applications with just a few clicks.
Prerequisites and Licensing
The Access Review feature requires one of the following licenses:
- Azure AD Premium P2
- Enterprise Mobility + Security E5
An overview of Microsoft 365 license packages with their features can be found at https://m365maps.com.
To create and review, the user must be assigned one of the following roles:
- Global administrator
- User administrator
- Identity governance administrator
Create access review
The access review is created in the Azure Portal (https://portal.azure.com) under “Identity Governance” > “Access Review”
Now the properties of the check can be set:
- What to review (applications or Microsoft 365 groups)
- Review Scope
- Which groups should be checked
- Which access group should be checked (guests only or all users)
- Consider users as inactive if they have not needed access for more than the specified number of days
Next, the reviewers and recurrence of the access review are determined.
- Who should receive the access verification invitation by email
- Is this access review one-time or recurring
Finally, the advanced settings and decision helpers are defined.
- How should the results of the access review be implemented
- Which information for the definition of the access authorization is mandatory
The access review check is created after clicking on “Create”.
The access review is now created. The invitations to the selected people are now sent by email.
The properties and status of the access review can be seen in the details.
Follow me on LinkedIn and get informed about my latest posts.
Was this post helpful to you? Show your enthusiasm with the delightful aroma of a freshly brewed coffee for me!
