Microsoft Certified: Identity and Access Administrator AssociateImplement access governanceMedium
A consulting company uses Microsoft Entra ID and has implemented access reviews for several Microsoft 365 groups. These groups are used to grant access to sensitive client data. The company has a strict policy that any access granted through these groups must be re-evaluated every 30 days. Furthermore, they need to ensure that if a group member's manager does not explicitly approve or deny their access during the review period, that member's access is automatically removed. Which two settings must be configured in the access review policy to enforce these requirements?
- AReview frequency: Monthly, and Upon completion: Take no action
- BReviewers: Selected users, and Auto apply results to resource
- CReview frequency: Monthly, and If reviewers don't respond: Remove access
- DReviewers: Group owners, and Send notifications to reviewers
Show answer & explanationAnswer & explanation
Correct answer: C. Review frequency: Monthly, and If reviewers don't respond: Remove access
To re-evaluate access every 30 days, the 'Review frequency' must be set to Monthly. To automatically remove access for unreviewed members, the 'If reviewers don't respond' setting must be configured to 'Remove access'.
Why the other options are wrong
- A. 'Take no action' for unreviewed users contradicts the requirement to automatically remove access.
- B. While 'Auto apply results' is important, 'Selected users' for reviewers doesn't guarantee the manager reviews, and this option doesn't address the 30-day frequency or the 'remove if no response' rule directly.
- D. These settings are about who reviews and communication, not the review frequency or automatic removal for non-response.
Access Review Frequency & Unreviewed Action
Settings within Microsoft Entra ID access reviews that define how often reviews occur and the default action taken for users whose access is not explicitly reviewed by the deadline.
- Review frequency ensures regular re-evaluation of access.
- 'If reviewers don't respond' controls the outcome for neglected reviews.
- Essential for maintaining a 'least privilege' posture by cleaning up stale access.
Memory trick: Monthly checks, silence means access lost.