2.4MS-102Advanced

Est: ~15 mins•Verified: 2026-08

Access Reviews, Entitlement Management & Privileged Access Groups

Implement automated identity governance using Microsoft Entra Access Reviews for guests and inactive accounts, configure Entitlement Management Access Packages, and secure critical groups via PIM Privileged Access.

Tags:#Microsoft 365#MS-102#Entra ID#Access Reviews#Entitlement Management#Governance#PIM

Overview

Identity sprawl, unmonitored guest memberships, and permanent standing permissions represent severe security risks in enterprise Microsoft 365 environments. Microsoft Entra ID Governance addresses these vulnerabilities through three interconnected systems:

Access Reviews: Automated, recurring certification campaigns requiring resource owners, managers, or users themselves to re-certify access to groups, applications, and directory roles. Non-responsive or denied access can trigger automatic removal.
Entitlement Management: Self-service access lifecycle management using Catalogs and Access Packages (bundles of group memberships, app assignments, and SharePoint sites with automated approval stages, expiration policies, and separation of duties).
Privileged Access Groups (PIM for Groups): Extends Privileged Identity Management (PIM) to security and M365 groups, allowing just-in-time (JIT) activation of group membership or group ownership with MFA and approval gates.

---

When to Use: Governance Component Selection

Scenario	Solution	Key Feature
Audit external guest access to sensitive Teams/SharePoint every 90 days	Access Reviews	Automatically disables or removes guest accounts if review is denied or unanswered.
New employee onboarding access bundle (Apps + Groups + Sites)	Entitlement Management	Single Access Package requested via `myaccess.microsoft.com` with manager approval.
Tier-1 Helpdesk requires temporary access to Cloud Admins security group	PIM for Groups	Eligible group membership activated for up to 8 hours with ticket justification.
Prevent inactive accounts (no sign-in for 90 days) from retaining access	Access Reviews (Inactivity filter)	Filters review candidates based on last sign-in timestamp.

---

Prerequisites

Administrator Permissions:

Identity Governance Administrator or Global Administrator.
Microsoft Entra ID Governance or Microsoft Entra ID P2 license for all reviewed or assigned users.

---

Portal Path

TEXT

Microsoft Entra Admin Center (https://entra.microsoft.com)
├── Identity governance
│   ├── Access reviews
│   │   ├── + New access review (Select Groups / Teams / Applications / Roles)
│   │   └── Settings (Upon completion: Remove access / Block sign-in)
│   ├── Entitlement management
│   │   ├── Catalogs (Container for resources: groups, apps, sites)
│   │   └── Access packages (Define assignment policies, approvals, lifecycle)
│   └── Privileged Identity Management
│       └── Groups (PIM for Groups: Configure Eligible vs Active members)

---

Step-by-Step Implementation

Step 1: Create an Access Review for Guest Users

In Identity governance, select Access reviews > click + New access review.
Select what to review: Teams + Groups > select All Microsoft 365 groups with guest users.
Scope: Guest users only.
Reviewers: Group owners (or Selected users). Fallback reviewer: Security team mailbox.
Recurrence: Quarterly, Duration: 14 days.
Upon completion settings:

Check Auto apply results to resource.
If reviewers don't respond: Remove access.

Click Create.

Step 2: Configure an Entitlement Management Access Package

In Entitlement management, click Catalogs > create Catalog-Engineering.
Add resources to catalog: Add Azure DevOps Security Group, Jira App, and Engineering SharePoint site.
Select Access packages > click + New access package.
Name: Engineering Developer Pack.
Resource roles: Assign Member role in the group, app, and site.
Requests policy:

Users who can request: Users in your directory.
Approval required: Yes (Stage 1: Requestor's Manager).

Lifecycle: Expire after 180 days; require re-certification via access review.

Step 3: Enable PIM for Groups

Navigate to Privileged Identity Management > Groups.
Discover groups > select SG-Tier2-Admins > click Enable PIM for this group.
Under Assignments, click + Add assignments:

Assignment type: Eligible.
Target member: Tier-2 technician.
Requires MFA, business ticket number, and max duration of 4 hours upon activation.

---

Microsoft Graph PowerShell SDK

PowerShell: Automate Access Review Creation via Graph API

PowerShell

# Connect to Graph SDK with Governance scopes
Connect-MgGraph -Scopes "AccessReview.ReadWrite.All", "Group.Read.All"

# 1. Target Group for Review
$targetGroup = Get-MgGroup -Filter "displayName eq 'SG-Cloud-Architects'"

# 2. Define Access Review Schedule and Policy Settings
$reviewSchedule = @{
    startDateTime = (Get-Date).ToUniversalTime().ToString("yyyy-MM-ddTHH:mm:ssZ")
    recurrence = @{
        pattern = @{
            type = "absoluteMonthly"
            interval = 3
        }
        range = @{
            type = "noEnd"
        }
    }
}

$reviewParams = @{
    displayName = "Quarterly Architecture Team Access Certification"
    description = "Validate that members still require Cloud Architect access."
    scope = @{
        "@odata.type" = "#microsoft.graph.accessReviewQueryScope"
        query = "/groups/$($targetGroup.Id)/transitiveMembers"
    }
    reviewers = @(
        @{
            query = "/groups/$($targetGroup.Id)/owners"
            queryType = "MicrosoftGraph"
        }
    )
    settings = @{
        mailNotificationsEnabled = $true
        reminderNotificationsEnabled = $true
        justificationRequiredOnApproval = $true
        defaultDecision = "Deny"
        defaultDecisionEnabled = $true
        autoApplyDecisionsEnabled = $true
        instanceDurationInDays = 14
    }
    schedule = $reviewSchedule
}

New-MgIdentityGovernanceAccessReviewDefinition -BodyParameter $reviewParams
Write-Host "Access Review created for group: $($targetGroup.DisplayName)" -ForegroundColor Green

---

Verification Checklist

VERIFICATION CHECKLIST

0/5 (0%)

Group owners receive automated email invitation when access review period opens.

Denied memberships in access reviews are automatically revoked within 24 hours of campaign closure.

Users request access packages through the My Access portal (https://myaccess.microsoft.com).

Manager approval triggers immediate automated provisioning of all bundled resources.

PIM for Groups prevents standing privileged membership and logs all JIT activations.

Common Pitfalls & Troubleshooting Matrix

Issue	Root Cause	Resolution
Reviewers do not receive email notification	Group has no active owners, or fallback reviewers are not configured.	Always define a fallback reviewer (e.g. security mailbox) in case group owners leave the company.
Denied guest users still have access	`Auto apply results to resource` was unchecked, or manual apply was not clicked.	Enable auto-apply in review settings, or manually click Apply after review closes.
My Access portal displays 'No packages available'	The access package policy is set to 'None' or restricted to specific connected organizations.	Verify policy settings under Users who can request access; set to 'All users in directory'.
PIM for Groups greyed out	Target group is synchronized from on-premises Active Directory.	PIM for Groups only supports cloud-native Entra ID security and M365 groups.

---

Real-World Architecture / Flow

Interactive Topology & Workflow

Identity Lifecycle Governance Flowsecurity

Stage 1

Flow & Verification Handshake

New Contractor Joinsclient

Stage 2

Flow & Verification Handshake

Stage 3

Flow & Verification Handshake

Automated Membership Provisioning:default

Stage 4

Teams: Financial Reporting Team

SharePoint: Secure Budget Repository

App: PowerBI Premium Workspace

---

Audit & Monitoring

Monitor Access Review completion and decision actions in Entra Audit Logs:
Service: Access Reviews
Activity: Apply access review, Review item denied, Review item approved.
Monitor Access Package requests:
Service: Entitlement Management
Activity: User request access package, Request approved.

---

Rollback & Emergency Recovery

Restore Denied Access:
If a legitimate user is accidentally denied during an access review, navigate to the group or access package and re-add the user or instruct them to re-request via My Access.
Stop an Ongoing Access Review:
In the access review details, click Stop to halt active evaluation immediately.

---

Official Documentation Reference

---

Exam Blueprint & Pro Tips (MS-102)

Exam Blueprint & High-Yield Traps

MS-102 High-Yield Rules:

Default Decision Options: If reviewers fail to respond, the default decisions are Approve, Deny, or Take recommendations (based on user sign-in activity in the last 30 days).
Cloud Groups Only for PIM: You cannot manage synchronized on-premises Active Directory groups with PIM for Groups.
Separation of Duties (SOD): Entitlement Management supports configuring incompatible access packages to prevent toxic combinations of permissions (e.g. Accounts Payable + Accounts Receivable).
Self-Review: Access Reviews can be configured for self-review, but for high-risk security roles, managerial or owner review is mandatory for audit compliance.

PREVIOUS TOPIC2.3 Entra Identity Protection: User & Sign-in Risk Policies NEXT TOPIC3.1 Defender for Office 365: Anti-Phishing & Safe Links