Detections
Analytics

5.3.2 Ensure 'Access reviews' for guest users are configured

Information

Access reviews enable administrators to establish an efficient automated process for reviewing group memberships, access to enterprise applications, and role assignments. These reviews can be scheduled to recur regularly, with flexible options for delegating the task of reviewing membership to different members of the organization. When configured for guest users, access reviews can automatically remove access if no reviewer responds within the review period, enforcing a fail-closed posture for external identities.

Access to groups and applications for guests can change over time. If a guest user's access to a particular resource goes unnoticed, they may unintentionally gain access to sensitive data if a member adds new files or data to the resource. Access reviews can help reduce the risks associated with outdated assignments by requiring a member of the organization to conduct the reviews. Furthermore, these reviews can enable a fail-closed mechanism to remove access to the subject if the reviewer does not respond to the review.

Solution

To remediate using the UI:

 - Navigate to Microsoft Entra admin center https://entra.microsoft.com/
 - Expand ID Governance and select Access reviews
 - Click New access review.
 - In the Resource review box click Select.
 - In Review Type set the following:

 - Select what to review choose Teams + Groups.
 - Review Scope to All Microsoft 365 groups with guest users.
 - Scope to Guest users only then click Next: Reviews.

 - In Reviews set the following:

 - Select reviewers to Group members or Selected users and groups, ensuring that at least one reviewer is assigned and that the guest is not performing a self-review.
 - Duration (in days) to 14 days or less.
 - Review recurrence to Monthly or more frequent.
 - Start date for the review, ensuring the review becomes active before the next audit date.
 - End to Never, then click Next: Settings.

 - In Settings set the following:

 - Auto apply results to resource is checked.
 - If reviewers don't respond to Remove access
 - Justification required is checked.
 - E-mail notifications is checked.
 - Reminders is checked.
 - Click Next: Review + Create

 - Click Create.

To remediate using the Microsoft Graph API:

To create a new access review, execute a POST request to the following relative URI. To update an existing review, execute a PATCH request to the same URI appended with the review's id :

v1.0/identityGovernance/accessReviews/definitions

The request body must include properties that satisfy the audit criteria above. The Graph API documentation provides complete sample request bodies in multiple languages including HTTP, PowerShell, and Python. See Reference 3 for details.

Impact:

Legitimate guest users may lose access to resources if designated reviewers fail to respond within the review window, requiring re-invitation and re-provisioning of access. Organizations with a large number of Microsoft 365 groups may face significant reviewer workload from monthly review cycles, which can lead to approval fatigue.

 - Microsoft Entra ID Governance licensing (included in Microsoft 365 E5) is required to configure access reviews.
 - As of January 15, 2026, a linked Azure subscription is required to use Entra ID Governance features for guest users.

See Also

https://workbench.cisecurity.org/benchmarks/24620

Item Details

Category: ACCESS CONTROL, AUDIT AND ACCOUNTABILITY

References: 800-53|AC-1, 800-53|AC-2, 800-53|AC-2(1), 800-53|AC-3, 800-53|AC-6, 800-53|AC-6(1), 800-53|AC-6(7), 800-53|AU-9(4)

Plugin: microsoft_azure

Control ID: 43bb440ebdeab0d32f49aedf8b5da59e61d42c17b2b2b4a05853f2a86ec53981