Access reviews and entitlement management
Entitlement management and access reviews are two halves of Microsoft Entra ID Governance. Entitlement management controls how access is requested, approved, granted and expired, using access packages. Access reviews ask people periodically whether existing access is still needed and can remove it. The decision rule: if the scenario is about getting access in the right way (request, approval, time limit, partner users), the answer is entitlement management; if it is about checking access that already exists (stale members, leaving guests, too many admins), the answer is an access review. Many good answers use both: an access package whose policy includes a recurring review.
Follow one guest through the lifecycle
A consultant from a partner company, Northwind, must work on a project site for six months. Walk through what each feature does.
- Package. The project owner is a delegated access package manager inside a catalog. The access package bundles a Microsoft 365 group, a Teams team and a SharePoint site, so the consultant gets all three as one item rather than three separate requests.
- Policy. The package has a policy for external users: only people from the connected organization Northwind may request, the project owner approves, and the assignment lasts 180 days.
- Request and approval. The consultant requests access. After approval, Entra ID invites the account through B2B and assigns the package, so no administrator invited anyone by hand.
- Review. Halfway through, the policy’s recurring access review asks the project owner, set as the reviewer, to confirm the consultant still needs access.
- Expiry. At the end of the assignment the access ends. If the consultant has no other access package assignments, the B2B guest account can be removed automatically.
Entitlement management supplied steps 1 to 3 and 5; an access review supplied step 4. Remove either half and the guest tends to keep access long after the project ends, the classic governance finding.
Entitlement management in four nouns
| Term | What it is |
|---|---|
| Catalog | A container of resources and of the people allowed to manage them. Catalogs are how you delegate to non-administrators |
| Access package | A bundle of resource roles that a person requests as one item. Always lives in a catalog |
| Policy | The rules on a package: who can request, who approves, how long the assignment lasts, whether reviews run |
| Connected organization | An external directory or domain whose users a policy may allow to request access |
A package can contain security group or Microsoft 365 group membership, Teams, enterprise applications and SharePoint Online sites. Groups also let you reach other things indirectly, for example Azure role assignments or licences given to a group. Policies can let users request access, or can assign it by an administrator or automatically from user properties such as department. Microsoft also describes using the feature for agent identities, which is marked as preview in the documentation, so do not expect it as a core exam point.
Access reviews in the settings you must recognise
An access review can cover group membership, application access, access package assignments, and, through Privileged Identity Management, Microsoft Entra roles and Azure resource roles. These settings decide most answers:
- Reviewers: selected users, group owners, managers of users, or users reviewing their own access. For managers and group owners you can add a fallback reviewer for users without a manager and groups without an owner.
- Scope: everyone, or guest users only. A related option reviews only inactive users.
- Recurrence and duration: a frequency such as weekly, monthly, quarterly or annually, with a duration for how long reviewers can respond.
- If reviewers don’t respond: No change, Remove access, Approve access, or Take recommendations.
- Auto apply results: with it on, denied users lose access when the review ends; with it off, an administrator must apply the results by hand.
- Decision helpers: a recommendation based on sign-in activity (no sign-in within 30 days) or on how far a user sits from the others in the group.
- Multi-stage reviews: two or three sequential sets of reviewers.
Combine two settings carefully. Microsoft warns that if non-response is set to Remove access or Take recommendations and auto apply is enabled, all access to the resource could be revoked when reviewers fail to answer.
Licensing: both features require Microsoft Entra ID Governance or Microsoft Entra Suite, with some capabilities working under Entra ID P2. Check the licensing page before quoting a licence in an answer.
Which exams test this
| Exam | How it appears | Where it is covered here |
|---|---|---|
| SC-300 | Plan and automate identity governance (20–25%): plan entitlements, build catalogs and access packages, handle access requests, terms of use, connected organizations and the lifecycle of external users; plan, create and monitor access reviews and act on them by hand | Identity governance |
| SC-900 | Capabilities of Microsoft Entra (25–30%): describe Microsoft Entra ID Governance and describe access reviews, at concept level. Entitlement management is not named on its own | Microsoft Entra |
| AZ-305 | Design identity, governance, and monitoring solutions (25–30%): recommend a solution for identity governance. Neither feature is named in the outline, so this is an indirect, design-level topic | Identity, governance and monitoring |
| SY0-801 | Security Operations (27%), objective 4.5 on identity and access management lists “access review” as a vendor-neutral concept. The Entra features themselves are not tested. Security+ V8 launches on November 17, 2026 | SY0-801 security operations explained |
SC-300 rows follow the English outline that applies from October 28, 2026, and SC-900 the one from October 21, 2026; neither change log records a change to the access review or entitlement management objectives.
How exam questions are built around it
Questions give you a business symptom and ask for the least-effort feature. Map the verb. Request, approve, bundle, partner, expire automatically means an access package. Periodically confirm, recertify, remove stale, owner or manager decides means an access review. The traps are close neighbours: Privileged Identity Management for elevation of admin roles just in time (see PIM), Conditional Access for conditions at sign-in (see Conditional Access), and dynamic groups for automatic membership without any human decision. Also watch the reviewer word: “users review their own access” is weaker than “managers”, and a guest scenario that must stay independent of the guest’s own opinion needs a different reviewer. A review of Entra roles or Azure resource roles is created in PIM, not in the access reviews blade.
Question 1. A company shares a project portal with staff from a partner organisation. Partner staff must request access themselves, a project owner must approve, and the access must end automatically after 90 days. Which feature should you configure?
- A. An entitlement management access package with an expiring policy
- B. A recurring access review on the portal group
- C. A Conditional Access policy requiring MFA for guests
- D. A dynamic group based on the guest’s email domain
Show answer
Answer: A
An entitlement management access package with an external-user policy supports requests from a connected organisation, an approver and an expiry. Access reviews check existing access but do not handle the request and approval flow. Conditional Access controls sign-in conditions, not assignment. A dynamic group assigns membership by attribute with no request or expiry.
Question 2. A quarterly access review of a group must remove guests whose managers do not respond. Nobody should have to apply results manually, but the group must never lose all its internal employees because reviewers were silent. How do you configure the review?
- A. Scope to everyone, non-response Remove access, auto apply on
- B. Scope to guest users only, non-response Approve access, auto apply on
- C. Scope to guest users only, non-response Remove access, auto apply off
- D. Scope to guest users only, non-response Remove access, auto apply on
Show answer
Answer: D
Scope the review to guest users only, set non-response to Remove access and enable auto apply: guests with no decision lose access, and employees are never in scope. Scoping to everyone with Remove access and auto apply could revoke all access if reviewers fail to respond. Approve access on non-response would keep silent guests. Leaving auto apply off means someone must apply the results by hand.