What this check looks at
Checks for an active, monthly (or more frequent) access review of guest users, with notifications and reminders, justification required, decisions applied automatically and access removed when nobody responds.
Access reviews, part of Microsoft Entra ID P2 and ID Governance, ask named reviewers at set intervals whether each person still needs their access, and can remove access automatically when the answer is no, or when nobody answers. A review can be scoped to guest users only, across Microsoft 365 groups and Teams.
The check, for tenants with Entra ID P2 or ID Governance, looks for a review of guest users that is active (not completed, and not waiting to start), recurs at least monthly, sends notifications and reminders, requires a reason for approvals, applies results automatically, and removes access when reviewers do not respond. It warns when a guest review exists but misses any of these, and fails when no review covers guests.
Guests arrive for a project and stay for years. Without regular reviews the guest list grows to include people from finished projects, former suppliers and staff of companies the client no longer works with, each still able to open the teams and files shared with them, and each protected only by someone else’s security.
Why it matters
Guests keep their access long after the project that brought them in has ended. A monthly review that removes anyone nobody vouches for keeps the guest list to people who still need to be there.
A typical case: a design agency’s former freelancer still has guest access to a client’s team two years after their last job. Their personal account is compromised, and the attacker downloads current client files from a team the freelancer had long forgotten. A monthly review would have removed the guest as soon as nobody vouched for them.
Stale guest access to personal data sits badly with the UK GDPR principles of data minimisation and security, and reviews give the client evidence for auditors and insurers that outside access is controlled. Each month, reviewers spend a few minutes confirming the guests they recognise.
The CIS Microsoft 365 Foundations Benchmark (5.3.2) asks for access reviews of guest users with these settings. The rule maps to NIST CSF 2.0 PR.AA-05.
How to fix it
Where: Entra admin centre → Identity governance → Access reviews
Before you start
- Needs Entra ID P2 or ID Governance. Agree who reviews (group owners or a named person) and tell them what to expect.
Step by step
- Agree the reviewers. Agree with the client who reviews: usually group and team owners, with a named person as fallback for groups without an owner. Tell them what the monthly email will look like and what to do with it.
- Start a new access review of guests. In the Microsoft Entra admin centre, go to ID Governance > Access reviews > New access review. Under Select what to review choose Teams + Groups, under Review scope choose All Microsoft 365 groups with guest users, and under Scope choose Guest users only. Select Next.
- Set the reviewers and the recurrence. Choose Group owner(s) as reviewers, with the fallback reviewers you agreed. Set the duration to about 7 days, Review recurrence to Monthly, Start date to today (a review waiting to start does not count) and End to Never. Select Next.
- Set the completion and advanced settings. Under Upon completion settings, tick Auto apply results to resource, set If reviewers don’t respond to Remove access, and choose what happens to denied guests (remove them from the resource, or block sign-in for 30 days and then remove them from the tenant). Under Advanced settings, tick Justification required, Email notifications and Reminders. Select Next, then Create.
- Check the first round. When the first instance starts, check reviewers received the email and can complete the review at https://myaccess.microsoft.com. Answer their questions, and look at the results when it ends.
- Confirm. In ID Governance > Access reviews, the review shows as active and monthly, with auto apply on and Remove access when reviewers do not respond. Re-run the assessment to confirm the finding passes.
What users will notice
Reviewers get a monthly email asking whether each guest still needs access. Guests nobody confirms lose access when the review ends.
How to confirm it worked
Identity governance, Access reviews: the review is Active, Monthly, with auto apply on and "If reviewers don’t respond" set to Remove access.
Frameworks and controls
This check maps to controls in 15 frameworks. Passing it is evidence that the setting is in place, not a certification against any of them.
| Framework | Control |
|---|---|
| NCSC CAF | B2.d Identity and access management (IdAM) |
| DSPT | Standard 4: Managing data access |
| DORA | Art. 9(4)(c) Limiting logical access to what is required |
| NIS2 | Art. 21(2)(i) Access control and asset management |
| Microsoft Cloud Security Benchmark | PA-4 Review and reconcile user access regularly |
| Zero Trust | Identities |
| SOC 2 | CC6.2 User registration, authorisation and removal |
| PCI DSS 4.0.1 | 7.2.4 User accounts and access privileges are reviewed every six months |
| NIST SP 800-171 | 3.1.1 Limit system access to authorised users, processes and devices |
| CMMC Level 2 | AC.L2-3.1.1 Authorized Access Control |
| ISO 27001:2022 | A.5.18 Access rightsA.5.16 Identity management |
| CIS M365 | 5.3.2 Ensure 'Access reviews' for guest users are configured |
| CIS Controls v8.1 | 5.1 Establish and maintain an inventory of accounts (IG1)6.2 Establish an access revoking process (IG1) |
| NIST CSF 2.0 | PR.AA-05: Access permissions, entitlements, and authorizations are defined in a policy, managed, enforced, and reviewed, and incorporate the principles of least privilege and separation of duties |
| NCSC 10 Steps | Identity and access management |
The framework mappings were last checked against the published standards in October 2026.
Microsoft’s documentation
- Manage guest access with access reviews (Microsoft Learn)