Access reviews are a critical pillar of modern identity governance. They help organizations ensure that users only have the access they need — no more, no less. From a compliance standpoint, regular access certification supports internal controls, reduces risk, and satisfies auditors.
But here’s the problem: many access review programs fail to achieve their goals. Reviews become check-the-box exercises. Reviewers rubber stamp entitlements. High-risk users retain access long after they should have been removed.
If that sounds familiar, you’re not alone.
In this post, we’ll break down five common pitfalls organizations run into when conducting access reviews, accompanied by practical fixes you can implement using Microsoft Entra ID Governance.
The Problem: Organizations try to review everything, all at once — every group, every role, every app. Review fatigue sets in, and reviewers stop paying attention.
Example: A large healthcare system launches quarterly reviews for all 8,000 Microsoft 365 groups. Department managers receive hundreds of review requests with no context or prioritization. Many simply approve them all to "clear their inbox."
The Fix: Prioritize reviews based on risk and sensitivity.
Key Takeaway: Start small and scale strategically. Quality beats quantity.
The Problem: Reviewers are asked to make decisions without knowing why the user has access, how often they use it, or whether their job still requires it.
Example: A finance manager is asked to review access to a legacy reporting tool. They see a list of 20 users but don’t recognize several names. Unsure whether the users still need access, they approve everyone to avoid blocking productivity.
The Fix: Provide actionable insights during the review process.
Microsoft Entra Access Reviews now include Access History and Decision Insights, which shows:
Combine this capability with justification requirements for reviewers to encourage thoughtful decisions.
Pro Tip: Train reviewers to use this context, especially for admin roles and guest access.
The Problem: Every decision is manual, even when the answer is obvious (e.g., inactive users, expired projects, duplicated access).
Example: A university’s IT staff conducts monthly reviews of Entra ID security groups. They manually assess whether users should stay in each group, despite half of the users showing no login activity for months and being listed as "inactive" in HR.
The Fix: Automate what you can and focus human effort where it matters.
Key Takeaway: Let policy handle low-risk cases. Save reviewers for the edge cases.
The Problem: Reviews are completed, but nothing happens. Access isn’t removed. Roles aren’t updated. Audit logs don’t match reality.
Example: An access review for Salesforce is completed successfully, and several users are marked for removal. But a month later, the users still have full access because no follow-up action was taken. The audit trail shows the decision but not the outcome.
The Fix: Enforce outcomes and close the loop.
Auditors care about two things: decisions made, and actions taken. Make sure both are logged and auditable.
The Problem: Nobody knows who should review access. Or worse — the wrong people are doing it (e.g., IT instead of business stakeholders).
Example: An access review for the HR payroll system is routed to the IT department. Since IT doesn't know which users should or shouldn’t have access, they approve everyone — including contractors whose roles ended months ago.
The Fix: Assign reviewers who understand the access process.
Business users know who should have access. Give them the tools to govern it.
Access reviews are a powerful tool. They, 1) provide visibility on “who has access to what,” and, 2) enable enforcement of models like “least privilege” — when done right. But when done poorly, they become busywork with little impact on security or compliance.
With Microsoft Entra ID Governance, you have everything you need to run smarter, more effective access reviews:
Access governance doesn’t need to be painful. Start by fixing one or two of these pitfalls, and you’ll begin to see the value — reduced risk, improved efficiency, and happier auditors.
1. Why Identity is the New Perimeter: Rethinking Security in a Cloud-First World
2. Microsoft Entra ID Governance: What’s New and Why it Matters
3. The Business Case for Lifecycle Workflows in Microsoft Entra ID
Principal Architect
Based out of the New York Metro/Northeast Region, Frank has 25+ years in the IT industry. Frank provides strategic architecture and consulting to organizations looking to improve security and achieve Zero Trust in their environments. His extensive experience in identity and access management, governance, compliance, and risk management allow him to understand a client’s business needs and how to properly implement the right technology to solve specific identity challenges.
