What are access reviews?

Definition

An access review is a recurring process in which the right owners confirm that each user’s access to systems and data is still appropriate, and revoke or adjust anything that isn’t.

Background

Access tends to accumulate: people change roles, projects end, and permissions granted “just for now” never get removed. Access reviews counter that drift. On a set cadence (often quarterly for sensitive systems), a reviewer looks at who has access to what and decides to keep, modify, or revoke it. This is a standard expectation of SOC 2 and ISO 27001, and it directly supports the principle of least privilege. Many identity platforms include a review feature. In Microsoft Entra ID, for example, access reviews are part of Microsoft Entra ID Governance. An administrator creates an access review in the Microsoft Entra admin center for the members of a security group or Microsoft 365 group, for access to an application, or for a role assignment, and chooses the reviewers. Reviewers can be the group owner, named users, each member’s manager, or the users themselves, who then review their own access. A review can be limited to guest users only, and the auto apply results to resource setting removes denied users when the review ends.

Why it matters

Excess access is one of the most common ways a minor incident becomes a major breach. Regular reviews shrink that blast radius, catch orphaned accounts, and give auditors the recertification records they specifically ask for. Frameworks name the control directly. ISO 27001 Annex A control A.5.18 covers provisioning, reviewing and removing access rights. SOC 2 criteria CC6.2 and CC6.3 cover granting and removing access. PCI DSS v4.0.1 requirement 7.2.4 asks for a review of user accounts and access privileges at least once every six months, and NIST CSF 2.0 subcategory PR.AA-05 expects access permissions to be reviewed.

Step by step

1. Define scope: which systems and data are sensitive enough to review, and how often.
2. Snapshot current access: who has what, ideally pulled from the source system.
3. Route each user’s access to the right reviewer (usually a manager or system owner).
4. For each, decide keep, modify, or revoke, and record the decision.
5. Action revocations promptly and keep the completed review as evidence.
6. Repeat on the cadence, and tie it into your joiner-mover-leaver process.
7. Review guest and external accounts on their own schedule, since they often outlive the project that needed them.
8. Set a default for reviewers who do not respond, so a missed review is chased or the access is removed instead of being kept by default.

Examples

• A quarterly review of admin access to the production database catches a former project member who no longer needs it.
• An offboarding triggers an immediate review and revocation rather than waiting for the next cycle.
• A company on Microsoft 365 runs a quarterly review of guest users in the groups behind its Teams, and group owners remove partners whose work has ended.
• In Keel, a team uploads a CSV of its staff, or syncs them from Microsoft Entra or Google Workspace on plans that include directory sync. It records a keep, revoke or modify decision for each person, and the finished review is saved as evidence the team can link to its access-review control.

Common mistakes

• Rubber-stamping reviews without actually checking whether access is still needed.
• Reviewing on paper but never revoking, so nothing changes.
• Only reviewing on a schedule and skipping reviews at role changes and offboarding.
• Letting people approve their own admin or production access. Self-review is fine for low-risk groups. Privileged access needs a second reviewer.
• Reviewing only the identity provider and missing local accounts in applications that do not use single sign-on.

FAQ