Entra ID Access Reviews

Business Problem

IDSentinel Solutions' quarterly security audit flagged a critical gap in its identity governance program: privileged group membership had never been formally reviewed since initial provisioning. GRP-SEC-PrivilegedUsers — granting elevated access to security tooling, audit logs, and sensitive configuration portals — had accumulated 188 members across Security, IT, Legal, Sales, HR, and other departments with no documented recertification and no process to remove access when a member's role changed.

A pre-review Graph API audit confirmed a secondary finding: the manager attribute was unpopulated for all 188 members in Active Directory — a common gap in hybrid environments where AD user objects are provisioned without the Organization tab fully populated — meaning no reviewer routing was possible until remediated.

Risk

Scope

Solution Design — 3 Workstreams

// diagrams/access-review-flow.png — Access review workflow diagram expand

Implementation

• 01

  Confirm Group in Entra ID

  GRP-SEC-PrivilegedUsers confirmed as an AD-synced Assigned Security group with 188 members. A second cloud-only Dynamic group also exists — the AD-synced Assigned group is the correct target as Dynamic groups cannot be scoped for manager-approval review workflows.

  // 01-group-created expand

  
• 02

  Pre-Review Baseline Audit (Graph API)

  Baseline script using Get-MgGroupMemberAsUser batch-retrieved all 188 member properties in a single Graph API call — avoiding per-member call timeouts on large groups. CSV exported as the SOC 2 "before" evidence.

  PowerShell

  .\scripts\Get-PrivilegedGroupBaseline.ps1

  // 02-pre-review-baseline expand

  
• 03

  Manager Attribute Remediation

  Finding: 188/188 members — manager attribute NOT SET. All review items would route to group owner fallback without remediation. Manager attribute set via AD PowerShell and synced to Entra via delta sync. Security department confirmed with manager set; remaining departments route to fallback as expected.

  PowerShell — remediate + sync

  .\scripts\Set-SecurityGroupManagers.ps1 -WhatIf  # Preview
  .\scripts\Set-SecurityGroupManagers.ps1          # Apply
  Start-ADSyncSyncCycle -PolicyType Delta          # Sync to Entra

  // 03-manager-verification expand

  
• 04

  Access Review Configured

  Entra ID Access Review configured with quarterly recurrence, manager approval with group owner fallback, auto-apply of review decisions, and justification required for all decisions.

  Setting	Value
  Reviewer type	Manager of each member
  Fallback reviewer	Group owner (Cleveland Oliver)
  Frequency	Quarterly — perpetual recurring series
  Duration	14 days
  Auto apply results	Enabled
  If reviewer doesn't respond	Remove access
  Justification required	Yes

  // 04-access-reviews-portal expand

  

  // 05-review-scope expand

  

  // 06-reviewer-config expand

  

  // 07-recurrence-settings expand

  

  // 08-auto-enforcement expand

  

  // 09-review-active expand

  
• 05

  Review Executed via MyAccess Portal

  Reviewer notification email received within minutes of activation. All 188 members reviewed at myaccess.microsoft.com with mandatory justification for each decision — 182 approved, 6 denied. 100% reviewer response rate.

  // 10-reviewer-email expand

  

  // 11a-approval-decision expand

  

  // 11b-denial-decision expand

  
• 06

  Hybrid Enforcement Finding and Remediation

  • Finding: Review status shows "Results Applied" but member count remains at 188 in Entra
  • Root cause: GRP-SEC-PrivilegedUsers is AD-synced — Entra Access Reviews auto-apply cannot remove members from AD-sourced groups
  • Lab remediation: 6 denied members removed via AD PowerShell + delta sync. Member count confirmed at 182
  • Production path: Automate post-review PowerShell reading denied decisions from Graph API and applying AD group changes, or migrate privileged groups to cloud-only membership

  // 12-post-review-membership expand

  
• 07

  Audit Trail Export + Membership Delta Report

  All review decisions, justifications, reviewer identities, and timestamps exported via Graph API. Post-review delta report confirmed: 182 RETAINED, 6 REMOVED, 0 unexpected additions.

  // 13-audit-trail-export expand

  

  // 14-membership-delta expand

  

Outcome

Review Results

Hybrid Environment Notes

Files

• scripts/Get-PrivilegedGroupBaseline.ps1 Batch member retrieval via Graph API — pre/post baseline audit
• scripts/Set-SecurityGroupManagers.ps1 Manager attribute remediation on Domain Controller
• scripts/Export-AccessReviewAuditTrail.ps1 Exports all review decisions, justifications, and timestamps via Graph API
• scripts/Get-PostReviewMembershipDelta.ps1 Before/after membership comparison using pre-review baseline CSV
• diagrams/access-review-flow.png Access review workflow diagram
• evidence/ SOC 2 CC6.2/CC6.3 audit trail export and pre/post membership delta CSVs
• screenshots/ Evidence of implementation at each stage — group baseline, review configuration, decisions, audit export

References

• Microsoft: Access reviews in Entra ID ↗
• Microsoft: Create an access review of groups ↗