Microsoft Certified: Identity and Access Administrator AssociateImplement access governanceMedium
A large pharmaceutical company uses Microsoft Entra ID and has delegated the management of several Microsoft 365 groups to department heads. These groups grant access to sensitive project files. The security team wants to implement access reviews for these groups, but they want the department heads to be responsible for reviewing their own group members' access, not a central IT team. Additionally, if the department head fails to review a member's access, that member's access should automatically be removed. Which access review settings should be configured?
- AReviewers: Selected users, and If reviewers don't respond: Take no action
- BReview frequency: Annually, and Allow access extensions
- CReviewers: Group owners, and Auto apply results to resource
- DReviewers: Managers of users, and Upon completion: Send notifications
Show answer & explanationAnswer & explanation
Correct answer: C. Reviewers: Group owners, and Auto apply results to resource
To have department heads review their own group members, set 'Reviewers' to 'Group owners'. To automatically remove access for unreviewed members, enable 'Auto apply results to resource' and ensure the default action for non-responsive reviewers is 'Remove access' (which is the default when auto-apply is enabled for group memberships if not explicitly overridden).
Why the other options are wrong
- A. 'Selected users' might not be the department heads, and 'Take no action' contradicts the automatic removal requirement.
- B. Review frequency and access extensions do not address who reviews or the automatic removal for non-responsive reviewers.
- D. 'Managers of users' is different from group owners, and 'Send notifications' doesn't enforce removal.
Access Review Delegation & Automation
Configuring Microsoft Entra access reviews to delegate review responsibilities (e.g., to group owners) and to automatically enforce review outcomes, including actions for non-responsive reviewers.
- Delegating reviews to group owners empowers resource governance.
- 'Auto apply results' enforces decisions (approve/deny) and default action for unreviewed.
- Default for unreviewed when auto-apply is on for group memberships is often 'Remove access'.
Memory trick: Owners review, system cuts if silent.