Set up Entra ID access reviews for groups, apps, and PIM roles

TL;DR — You can set up Entra ID access reviews fastest in the Entra admin center, but Graph is the better path if you need repeatability. The most common blocker is scoping the review to the wrong resource type or lacking the required Entra ID Governance / P2 licensing, so verify licensing and target object IDs before creating anything. Reading time: ~5 min

Goal

When you finish, your tenant will have active Entra ID access reviews for at least one group, one enterprise application assignment set, and one privileged role, with reviewers receiving review tasks and the review definitions visible as recurring schedules in Entra.

Prerequisites

• Entra tenant admin access with one of these roles: Identity Governance Administrator, Privileged Role Administrator, or Global Administrator
• Licensing that includes Entra ID Governance or Entra ID P2 for the users covered by reviews
• A test group, a test enterprise application with assigned users/groups, and at least one eligible or active privileged role assignment to review
• Microsoft Graph PowerShell SDK installed; check with:

pwsh -NoLogo -Command "Get-InstalledModule Microsoft.Graph -ErrorAction SilentlyContinue | Select-Object Name,Version"

• PowerShell 7+; check with:

pwsh --version

• The object IDs for the target group, service principal, and directory role definition or PIM role scope you want to review
• Browser access to the Entra admin center

Steps

Step 1: Connect to Microsoft Graph with the right scopes

Run:

pwsh
Connect-MgGraph -Scopes "AccessReview.ReadWrite.All","Group.Read.All","Application.Read.All","RoleManagement.Read.Directory","RoleManagementPolicy.Read.Directory","Directory.Read.All"
Get-MgContext | Select-Object TenantId,Scopes

You should see your tenant ID and the requested scopes in the output.

Step 2: Get the target IDs you will use

For a group, run:

Get-MgGroup -Filter "displayName eq 'Engineering-Prod-Admins'" | Select-Object Id,DisplayName

For an enterprise application service principal, run:

Get-MgServicePrincipal -Filter "displayName eq 'GitHub Enterprise Cloud'" | Select-Object Id,DisplayName,AppId

For directory roles, run:

Get-MgRoleManagementDirectoryRoleDefinition | Select-Object Id,DisplayName | Sort-Object DisplayName

You should get one ID per object you intend to review.

Step 3: Create a group membership access review

In the Entra admin center, go to:

Identity Governance → Access reviews → New access review

Use these literal values:

What to review? → Teams + Groups
Select teams + groups → Engineering-Prod-Admins
Review scope → All users
Reviewers → Group owners
Upon completion settings → Auto apply results to resource
If reviewers don't respond → Remove access
Justification required → Yes
Review frequency → Monthly
Duration in days → 14
End → Never
Name → Monthly review - Engineering-Prod-Admins

Click:

Start

You should see a new review definition with status Active or Scheduled.

Step 4: Create an application assignment access review

In the Entra admin center, go to:

Identity Governance → Access reviews → New access review

Use these literal values:

What to review? → Applications
Select applications → GitHub Enterprise Cloud
Review scope → Users assigned to application
Reviewers → Selected users
Selected users → your-admin-account@yourtenant
Upon completion settings → Auto apply results to resource
If reviewers don't respond → Remove access
Justification required → Yes
Review frequency → Quarterly
Duration in days → 14
End → After 4 occurrences
Name → Quarterly review - GitHub Enterprise Cloud assignments

Click:

Start

You should see a second review definition targeting the application.

Step 5: Create a privileged role access review

In the Entra admin center, go to:

Identity Governance → Access reviews → New access review

Use these literal values:

What to review? → Azure AD roles
Select roles → User Administrator
Review scope → Eligible assignments and active assignments
Reviewers → Selected users
Selected users → your-admin-account@yourtenant
Upon completion settings → Auto apply results to resource
If reviewers don't respond → Remove access
Justification required → Yes
Review frequency → Monthly
Duration in days → 7
End → Never
Name → Monthly review - User Administrator role

Click:

Start

You should see the role review listed with the target role name.

Step 6: Create the same review by Graph if you need repeatability

For group reviews, the least fragile route is to inspect one review created in the portal, then template it. First list definitions:

Invoke-MgGraphRequest -Method GET -Uri "https://graph.microsoft.com/v1.0/identityGovernance/accessReviews/definitions" | ConvertTo-Json -Depth 10

Then fetch one definition by ID:

$defId = "<ACCESS_REVIEW_DEFINITION_ID>"
Invoke-MgGraphRequest -Method GET -Uri "https://graph.microsoft.com/v1.0/identityGovernance/accessReviews/definitions/$defId" | ConvertTo-Json -Depth 20

You should see a JSON document containing the exact scope, reviewers, recurrence, and settings shape used by your tenant.

Step 7: Start one-time diagnostics if creation fails

If the portal errors, test Graph directly and inspect the response body:

try {
  Invoke-MgGraphRequest -Method GET -Uri "https://graph.microsoft.com/v1.0/identityGovernance/accessReviews/definitions"
} catch {
  $_.Exception.Response.StatusCode.value__
  $_.ErrorDetails.Message
}

A successful call returns HTTP 200 with a JSON value array; permission or licensing issues return 403 with a message naming the missing permission or unsupported scenario.

Verify it works

Check all three review types exist in the portal:

Identity Governance → Access reviews

Expected result: three entries with names matching the ones you created and status Active or Scheduled.

Verify by Graph that definitions exist:

Invoke-MgGraphRequest -Method GET -Uri "https://graph.microsoft.com/v1.0/identityGovernance/accessReviews/definitions" | Select-Object -ExpandProperty value | Select-Object displayName,status

Expected output shape:

[
  {
    "displayName": "Monthly review - Engineering-Prod-Admins",
    "status": "InProgress"
  },
  {
    "displayName": "Quarterly review - GitHub Enterprise Cloud assignments",
    "status": "NotStarted"
  },
  {
    "displayName": "Monthly review - User Administrator role",
    "status": "InProgress"
  }
]

Verify reviewers received tasks:

My Access portal → Reviews

Expected result: the selected reviewer or group owner sees pending review items for the target group, application, or role.

Common pitfalls

Wrong resource type selected

Mistake: creating a group review under Applications or a role review under Teams + Groups. Symptom: the target object does not appear in the picker, or the review creates but covers the wrong assignments. Fix: recreate it under the exact path matching the object type: Teams + Groups, Applications, or Azure AD roles.

Missing licensing for covered users

Mistake: the admin account is licensed, but reviewed users are not covered by Entra ID Governance/P2. Symptom: portal creation fails, or Graph returns 403 with a licensing-related message. Fix: assign the required license to all users in scope, then create the review again.

Reviewing the app registration instead of the enterprise application

Mistake: using the application object/app registration when the review targets user assignments. Symptom: no assignments appear to review because assignments live on the service principal. Fix: select the enterprise application in the portal, or use the service principal ID from Get-MgServicePrincipal.

No group owners assigned

Mistake: setting Reviewers → Group owners on a group with zero owners. Symptom: review starts but nobody receives review tasks. Fix: add at least one owner to the group, or switch reviewers to Selected users.

PIM role scope confusion

Mistake: expecting a privileged role review to cover Azure resource roles or a different scope than directory roles. Symptom: the desired role is missing from the picker, or the review covers only Entra directory roles. Fix: create the review under Azure AD roles for directory roles; use the matching PIM workflow for Azure resource roles.

Auto-apply removes access unexpectedly

Mistake: enabling Auto apply results with "If reviewers don't respond → Remove access" on a broad scope without a dry run. Symptom: users lose group membership, app assignment, or role eligibility at review close. Fix: test first on a small pilot group or set non-responses to No change for the first cycle.

This article was written by an AI system and published pending human review. Verify anything you intend to act on.