Overview
Access to privileged Azure AD roles for employees changes over time. To reduce the risk associated with stale role assignments, you should regularly review access. You can use Azure Active Directory (Azure AD) Privileged Identity Management (PIM) to create access reviews for privileged Azure AD roles. You can also configure recurring access reviews that occur automatically.
This blog post shows how to create access reviews for privileged Azure AD roles.
Open access reviews
Sign in to Azure portal with a user that is a member of the Privileged Role Administrator role.
Click All services and find the Azure AD Privileged Identity Management service.
In the left menu, click Azure AD roles
Under Manage, click Access reviews.
Create access reviews
Click New to create a new access review.
Name the access review. Optionally, give the review a description. The name and description are shown to the reviewers.
Set the Start date. By default, an access review occurs once, starts the same time it’s created, and it ends in one month. You can change the start and end dates to have an access review start in the future and last however many days you want.
To make the access review recurring, change the Frequency setting from One time to Weekly, Monthly, Quarterly, Annually, or Semi-annually. Use the Duration slider or text box to define how many days each review of the recurring series will be open for input from reviewers. For example, the maximum duration that you can set for a monthly review is 27 days, to avoid overlapping reviews.
Use the End setting to specify how to end the recurring access review series. The series can end in three ways: it runs continuously to start reviews indefinitely, until a specific date, or after a defined number of occurrences has been completed. You, another User administrator, or another Global administrator can stop the series after creation by changing the date in Settings, so that it ends on that date.
In the Users section, select one or more roles that you want to review membership of.
In the Reviewers section, select one or more people to review all the users. Or you can select to have the members review their own access.
- Selected users – Use this option when you don’t know who needs access. With this option, you can assign the review to a resource owner or group manager to complete.
- Members (self) – Use this option to have the users review their own role assignments.
Upon completion settings
To specify what happens after a review completes, expand the Upon completion settings section.
If you want to automatically remove access for users that were denied, set Auto apply results to resource to Enable. If you want to manually apply the results when the review completes, set the switch to Disable.
Use the Should reviewer not respond list to specify what happens for users that are not reviewed by the reviewer within the review period. This setting does not impact users who have been reviewed by the reviewers manually. If the final reviewer’s decision is Deny, then the user’s access will be removed.
- No change – Leave user’s access unchanged
- Remove access – Remove user’s access
- Approve access – Approve user’s access
- Take recommendations – Take the system’s recommendation on denying or approving the user’s continued access
Advanced settings
To specify additional settings, expand the Advanced settings section.
Set Show recommendations to Enable to show the reviewers the system recommendations based the user’s access information.
Set Require reason on approval to Enable to require the reviewer to supply a reason for approval.
Set Mail notifications to Enable to have Azure AD send email notifications to reviewers when an access review starts, and to administrators when a review completes.
Set Reminders to Enable to have Azure AD send reminders of access reviews in progress to reviewers who have not completed their review.
Start the access review
Once you have specified the settings for an access review, click Start. The access review will appear in your list with an indicator of its status.
By default, Azure AD sends an email to reviewers shortly after the review starts. If you choose not to have Azure AD send the email, be sure to inform the reviewers that an access review is waiting for them to complete.
Abou Conde's Blog 