What this check looks at
Checks for active, monthly (or more frequent) access reviews of Global Administrator and the other highly privileged roles, lasting no more than 14 days, with decisions applied automatically.
Privileged Identity Management can run access reviews of Microsoft Entra roles: at each review, reviewers confirm whether each person assigned the role, eligible or active, still needs it, and denied assignments (or unconfirmed ones, if you choose) are removed when the review ends.
The check, for tenants with Entra ID P2 or ID Governance, looks for active role reviews that recur at least monthly, last no more than 14 days, send notifications and reminders, require a reason for approvals, and apply results automatically. It passes when Global Administrator and Privileged Role Administrator each have such a review. It warns when role reviews exist but one of the two has no qualifying review, and fails when no review covers the privileged roles.
Administrator roles accumulate: someone is given Global Administrator for a migration and keeps it, a former IT contractor stays eligible, an MSP engineer who has left still has an assignment. Each is a powerful account an attacker can target, and without a review nobody is asked whether it should still be there.
Why it matters
People collect administrator roles and keep them after they move on. A monthly review where someone must confirm each holder still needs the role is how standing privilege is kept to the people who use it.
In MSP-managed tenants it is common to find eight or ten Global Administrators where two or three are needed, including the accounts of people who have left the MSP or the client. Any one of them, phished or with a reused password, gives full control. A monthly review removes them within weeks of their no longer being needed.
Reviews also leave a record that each privileged assignment was checked by someone other than its holder, which auditors and cyber insurers increasingly ask for. The effort is small: a handful of assignments to confirm once a month.
The CIS Microsoft 365 Foundations Benchmark (5.3.3) asks for access reviews of privileged roles with these settings. The rule maps to NIST CSF 2.0 PR.AA-05.
How to fix it
Where: Entra admin centre → Identity governance → Privileged Identity Management → Access reviews
Before you start
- Needs Entra ID P2. Choose reviewers other than the role holders themselves where possible.
Step by step
- Choose the reviewers. Choose reviewers other than the role holders where possible, such as the client’s IT lead or the MSP’s service manager, so nobody approves their own access.
- Create a review for Global Administrator. In the Microsoft Entra admin centre, go to ID Governance > Privileged Identity Management > Microsoft Entra roles > Access reviews and select New. Name it "Monthly review – Global Administrator", set the start date to today, frequency Monthly, duration 14 days or fewer and end Never. Under the roles to review, select Global Administrator only, covering both active and eligible assignments.
- Set the reviewers and completion settings. Choose Selected user(s) or group(s) as reviewers and add them. Under Upon completion settings, set Auto apply results to resource to Enable and choose what happens if reviewers do not respond (Remove access is safest). Under Advanced settings, turn on Require reason on approval, Mail notifications and Reminders. Start the review.
- Create the same review for Privileged Role Administrator. Repeat for Privileged Role Administrator as a review of its own. Keep one role per review: each role’s decisions stay clear, and this check matches each review to a single role. Add similar reviews for the other highly privileged roles in use, such as Exchange, SharePoint and User Administrator.
- Check the first round. When the first instance starts, check reviewers received the email and can complete the review in PIM or at https://myaccess.microsoft.com, and look at the results when it ends.
- Confirm. In PIM > Microsoft Entra roles > Access reviews, the reviews for Global Administrator and Privileged Role Administrator show as active, monthly, 14 days or less, with auto apply on. Re-run the assessment to confirm the finding passes.
What users will notice
Reviewers are asked monthly to confirm who still needs each privileged role; unconfirmed assignments are removed when the review ends.
How to confirm it worked
PIM, Microsoft Entra roles, Access reviews: an active monthly review covers Global Administrator and the other highly privileged roles, lasting 14 days or less.
Frameworks and controls
This check maps to controls in 15 frameworks. Passing it is evidence that the setting is in place, not a certification against any of them.
| Framework | Control |
|---|---|
| NCSC CAF | B2.c Privileged user management |
| DSPT | Standard 4: Managing data access |
| DORA | Art. 9(4)(c) Limiting logical access to what is required |
| NIS2 | Art. 21(2)(i) Access control and asset management |
| Microsoft Cloud Security Benchmark | PA-4 Review and reconcile user access regularly |
| Zero Trust | Identities |
| SOC 2 | CC6.2 User registration, authorisation and removalCC6.3 Role-based access and least privilege |
| PCI DSS 4.0.1 | 7.2.4 User accounts and access privileges are reviewed every six months |
| NIST SP 800-171 | 3.1.5 Employ the principle of least privilege |
| CMMC Level 2 | AC.L2-3.1.5 Least Privilege |
| ISO 27001:2022 | A.5.18 Access rightsA.8.2 Privileged access rights |
| CIS M365 | 5.3.3 Ensure 'Access reviews' for privileged roles are configured |
| CIS Controls v8.1 | 6.8 Define and maintain role-based access control (IG3) |
| NIST CSF 2.0 | PR.AA-05: Access permissions, entitlements, and authorizations are defined in a policy, managed, enforced, and reviewed, and incorporate the principles of least privilege and separation of duties |
| NCSC 10 Steps | Identity and access management |
The framework mappings were last checked against the published standards in October 2026.
Microsoft’s documentation
- Create an access review of Microsoft Entra roles in PIM (Microsoft Learn)