{
  "id": "CB-M365-ADMIN-010",
  "standard": "m365",
  "version": "main",
  "url": "https://baselines.cirsec.org/b/m365/CB-M365-ADMIN-010",
  "json": "https://baselines.cirsec.org/b/m365/CB-M365-ADMIN-010.json",
  "yaml": "https://baselines.cirsec.org/b/m365/CB-M365-ADMIN-010.yml",
  "profiles_effective": [
    "baseline",
    "hardened"
  ],
  "license": "Text CC BY 4.0, code Apache-2.0",
  "attribution": "CIRSEC Baselines, https://baselines.cirsec.org",
  "control": {
    "id": "CB-M365-ADMIN-010",
    "title": "Review privileged role assignments periodically",
    "finding": {
      "title": "Privileged role assignments are never reviewed",
      "description": "Administrators keep roles after changing jobs or finishing projects, and nobody checks whether each assignment is still needed."
    },
    "status": "active",
    "profiles": [
      "baseline"
    ],
    "risk": {
      "severity": "medium"
    },
    "assessment": "manual",
    "tags": [
      "privileged-access",
      "access-reviews",
      "pim",
      "governance"
    ],
    "applicability": {
      "requires": [
        "Microsoft Entra ID P2"
      ]
    },
    "parameters": [
      {
        "name": "role_review_frequency",
        "type": "enum",
        "description": "Recurrence of the privileged role access review.",
        "default": "quarterly",
        "allowed": [
          "weekly",
          "monthly",
          "quarterly"
        ]
      }
    ],
    "description": "A recurring access review in Privileged Identity Management covers the highly privileged roles\n(list in CB-M365-ADMIN-006), both eligible and active assignments, every\n`{{ role_review_frequency }}`. The review:\n\n- has reviewers who are not reviewing themselves (a security manager, or the managers of the\n  role holders);\n- enables mail notifications and reminders, and requires a reason on approval;\n- lasts 14 days or less;\n- applies results automatically at the end.\n",
    "rationale": "Privileges accumulate: people change teams, projects end, contractors leave, and roles stay.\nA periodic review by someone other than the holder removes assignments nobody can justify and\ndocuments the ones that remain, which auditors ask for.\n",
    "impact": "Reviewers spend some time each cycle. If **If reviewers don't respond** is set to remove access,\na missed review can remove an administrator: keep it on **No change** for roles and follow up\nlate reviews.\n",
    "notes": "Unused and orphaned assignments between reviews are covered by CB-M365-ADMIN-011.\n",
    "audit": {
      "manual": "1. Sign in to the Microsoft Entra admin center (https://entra.microsoft.com) as at least a\n   Global Reader.\n2. Browse to **ID Governance** > **Privileged Identity Management** > **Microsoft Entra\n   roles** > **Access reviews** (or **ID Governance** > **Access reviews**).\n3. Find an active review whose scope includes the highly privileged roles, with **Role\n   assignment type** **Eligible and Active**, and check: reviewers are not the holders\n   themselves; **Frequency** is `{{ role_review_frequency }}` or more frequent; **Duration**\n   14 days or less; **Mail notifications**, **Reminders**, **Require reason on approval** and\n   **Auto apply results to resource** are enabled.\n4. Open the last completed instance and check that decisions were taken.\n5. Read-only alternative with Microsoft Graph (scope `AccessReview.Read.All`):\n   `GET /identityGovernance/accessReviews/definitions` and look for a definition whose scope\n   queries `/roleManagement/directory/roleAssignmentScheduleInstances` or\n   `roleEligibilityScheduleInstances`.\n6. Fail if no such review exists, if it is less frequent than the parameter, or if its last\n   instance was not completed.\n"
    },
    "remediation": {
      "manual": "1. With a Privileged Role Administrator (or Identity Governance Administrator), browse to\n   **ID Governance** > **Privileged Identity Management** > **Microsoft Entra roles** >\n   **Access reviews** > **New**.\n2. Name it, set **Frequency** to `{{ role_review_frequency }}`, **Duration** to 14 days or\n   less, **End** to **Never**.\n3. **Scope**: **Users and Groups**; **Role**: select the highly privileged roles;\n   **Assignment type**: **Eligible and Active**.\n4. **Reviewers**: selected users (security manager) or **Manager**, with a fallback reviewer.\n5. **Upon completion settings**: **Auto apply results to resource** **Enable**; **If\n   reviewers don't respond** **No change**.\n6. **Advanced settings**: enable **Require reason on approval**, **Mail notifications** and\n   **Reminders**. Select **Start**.\n",
      "rollback": "Stop or delete the access review; decisions already applied are not reverted.\n"
    },
    "references": [
      {
        "title": "Create an access review of Azure resource and Microsoft Entra roles in PIM",
        "url": "https://learn.microsoft.com/entra/id-governance/privileged-identity-management/pim-create-roles-and-resource-roles-review",
        "publisher": "Microsoft",
        "kind": "vendor-doc",
        "accessed": "2026-10-24"
      },
      {
        "title": "What are access reviews?",
        "url": "https://learn.microsoft.com/entra/id-governance/access-reviews-overview",
        "publisher": "Microsoft",
        "kind": "vendor-doc",
        "accessed": "2026-10-24"
      }
    ],
    "mappings": [
      {
        "framework": "anssi-admin",
        "framework_version": "3.0",
        "id": "R32",
        "relation": "partial",
        "note": "Covers the periodic review of privileged roles, one part of the admin account management process."
      },
      {
        "framework": "nist-800-53r5",
        "framework_version": "5.1.1",
        "id": "AC-6(7)",
        "relation": "related"
      },
      {
        "framework": "nist-800-53r5",
        "framework_version": "5.1.1",
        "id": "AC-2",
        "relation": "related"
      }
    ],
    "related_controls": [
      {
        "id": "CB-M365-ADMIN-006",
        "type": "related"
      },
      {
        "id": "CB-M365-ADMIN-011",
        "type": "related"
      }
    ],
    "authors": [
      {
        "name": "Alice",
        "github": "Sn0wAlice"
      }
    ],
    "introduced_in": "0.1.0",
    "created": "2026-10-24",
    "updated": "2026-10-24"
  }
}