Review privileged role assignments periodically

Description

A recurring access review in Privileged Identity Management covers the highly privileged roles (list in CB-M365-ADMIN-006), both eligible and active assignments, every {{ role_review_frequency }}. The review:

• has reviewers who are not reviewing themselves (a security manager, or the managers of the role holders);
• enables mail notifications and reminders, and requires a reason on approval;
• lasts 14 days or less;
• applies results automatically at the end.

Unused and orphaned assignments between reviews are covered by CB-M365-ADMIN-011.

Rationale

Privileges accumulate: people change teams, projects end, contractors leave, and roles stay. A periodic review by someone other than the holder removes assignments nobody can justify and documents the ones that remain, which auditors ask for.

Impact

Reviewers spend some time each cycle. If If reviewers don't respond is set to remove access, a missed review can remove an administrator: keep it on No change for roles and follow up late reviews.

Applies when

Requires: Microsoft Entra ID P2

Parameters

The value used is your override (tailoring file), else the profile's, else the one of the profile it extends, else the default. Bounds limit what an override may set.

Audit

1. Sign in to the Microsoft Entra admin center (https://entra.microsoft.com) as at least a Global Reader.
2. Browse to ID Governance > Privileged Identity Management > Microsoft Entra roles > Access reviews (or ID Governance > Access reviews).
3. Find an active review whose scope includes the highly privileged roles, with Role assignment type Eligible and Active, and check: reviewers are not the holders themselves; Frequency is {{ role_review_frequency }} or more frequent; Duration 14 days or less; Mail notifications, Reminders, Require reason on approval and Auto apply results to resource are enabled.
4. Open the last completed instance and check that decisions were taken.
5. Read-only alternative with Microsoft Graph (scope AccessReview.Read.All): GET /identityGovernance/accessReviews/definitions and look for a definition whose scope queries /roleManagement/directory/roleAssignmentScheduleInstances or roleEligibilityScheduleInstances.
6. Fail if no such review exists, if it is less frequent than the parameter, or if its last instance was not completed.

Remediation

1. With a Privileged Role Administrator (or Identity Governance Administrator), browse to ID Governance > Privileged Identity Management > Microsoft Entra roles > Access reviews > New.
2. Name it, set Frequency to {{ role_review_frequency }}, Duration to 14 days or less, End to Never.
3. Scope: Users and Groups; Role: select the highly privileged roles; Assignment type: Eligible and Active.
4. Reviewers: selected users (security manager) or Manager, with a fallback reviewer.
5. Upon completion settings: Auto apply results to resource Enable; If reviewers don't respond No change.
6. Advanced settings: enable Require reason on approval, Mail notifications and Reminders. Select Start.

Rollback

Stop or delete the access review; decisions already applied are not reverted.

References

• Create an access review of Azure resource and Microsoft Entra roles in PIM Microsoft, vendor-doc, accessed 2026-10-24
• What are access reviews? Microsoft, vendor-doc, accessed 2026-10-24

Mappings

How this control relates to the other framework's: equivalent, stricter, looser, partial or related.

Related controls

• related CB-M365-ADMIN-006 Grant highly privileged roles just in time through Privileged Identity Management
• related CB-M365-ADMIN-011 Remove unused and orphaned privileged role assignments

People and lifecycle