Conduct access reviews of existing resources
Implementation Effort: High – IT and governance teams must configure and schedule access reviews, define review scopes, and coordinate with resource owners and reviewers across the organization.
User Impact: Medium – Users may be required to participate in access reviews, which could result in changes to their access permissions based on review outcomes.
Overview
Conducting access reviews of existing resources is a critical step in establishing a baseline for access governance within Microsoft Entra ID. This process involves evaluating current access assignments to applications and groups memberships to ensure that only authorized users retain access. By performing these reviews, organizations can identify and remediate excessive, unnecessary, or outdated permissions, thereby reducing the risk of unauthorized access and potential security breaches.
Access reviews can be configured for various resource types, including access packages, Microsoft 365 groups, security groups, and enterprise applications. Reviewers can be designated as resource owners, managers, or specific individuals responsible for access decisions. The reviews can be scheduled to occur periodically, ensuring ongoing compliance with access policies and organizational requirements.
This approach aligns with the Zero Trust principles by enforcing "Verify explicitly" through regular validation of user access rights and "Use least privilege access" by ensuring users have only the necessary permissions for their roles. Failure to conduct access reviews can lead to the accumulation of stale or inappropriate access rights, increasing the organization's exposure to insider threats and compliance violations.