Detections
Analytics

5.3.3 Ensure 'Access reviews' for privileged roles are configured

Information

Access reviews in Microsoft Entra Privileged Identity Management (PIM) enable administrators to periodically validate whether users still require their privileged role assignments. These reviews can be scheduled to recur on a regular cadence and can be delegated to reviewers other than the role holders themselves, such as security auditors.

Regular review of critical high privileged roles in Entra ID will help identify role drift, or potential malicious activity. This will enable the practice and application of "separation of duties" where even non-privileged users like security auditors can be assigned to review assigned roles in an organization.

These reviews can optionally be configured to automatically remove access if a reviewer does not respond within the review window, though this recommendation conservatively sets non-response to result in no change to avoid inadvertent removal of privileged accounts including break-glass accounts.

Solution

Note: An access review is created for each role selected after completing the process.

To remediate using the UI:

 - Navigate to Microsoft Entra admin center https://entra.microsoft.com/
 - Expand ID Governance > Privileged Identity Management.
 - Select Microsoft Entra Roles under Manage.
 - Select Access reviews and click New.

 - Provide a name and description.
 - Set Frequency to Monthly or more frequently.
 - Set Duration (in days) to at most 14.
 - Set End to Never.
 - Set Users scope to All users and groups.
 - In Role select the directory roles outlined in the Additional Information section.
 - Set Assignment type to All active and eligible assignments.
 - Set Reviewers to member(s) responsible for this type of review, other than self.

 - In Upon completion settings set the following:

 - Auto apply results to resource to Enable.
 - If reviewers don't respond to No change.

 - In Advanced settings set the following:

 - Require reason on approval to Enable
 - Mail notifications to Enable
 - Reminders to Enable

 - Click Start to save and begin the review series.

Warning: Care should be taken when configuring the If reviewers don't respond setting for Global Administrator reviews, if misconfigured break-glass accounts could automatically have roles revoked. Additionally, reviewers should be educated on the purpose of break-glass accounts to prevent accidental manual removal of roles.

To remediate using the Microsoft Graph API:

To create a new access review, execute a POST request to the following relative URI. To update an existing review, execute a PATCH request to the same URI appended with the review's id :

v1.0/identityGovernance/accessReviews/definitions

The request body must include properties that satisfy the audit criteria above. The Graph API documentation provides complete sample request bodies in multiple languages including HTTP, PowerShell, and Python. See Reference 3 for details

Impact:

In order to avoid disruption reviewers who have the authority to revoke roles should be trusted individuals who understand the significance of access reviews. Additionally, the principle of separation of duties should be applied to ensure that no administrator is responsible for reviewing their own access levels. This will cause additional administrative overhead.

If the reviews are configured to automatically revoke highly privileged roles like the Global Administrator role, then this could result in removing all Global Administrators from the organization. Care should be taken when configuring this setting especially in the case of break-glass accounts which would be included in the scope.

 - Microsoft Entra ID Governance licensing (included in Microsoft 365 E5) is required to configure access reviews.

See Also

https://workbench.cisecurity.org/benchmarks/24620

Item Details

Category: ACCESS CONTROL, AUDIT AND ACCOUNTABILITY

References: 800-53|AC-1, 800-53|AC-2, 800-53|AC-2(1), 800-53|AC-3, 800-53|AC-6, 800-53|AC-6(1), 800-53|AC-6(7), 800-53|AU-9(4)

Plugin: microsoft_azure

Control ID: 3778054783dd3d0ce1a4028e1e9650b7d47c5f975caece40e58b218320b6e8e0