Skip to content

Run a quarterly access review of privileged roles and alert on roles assigned outside PIM

Control
PA05
Kit
Privileged access and PIM
Area
Admin accounts and reviews
Priority
High
Effort
2 h
Last reviewed

Licence and role

PIM: Microsoft Entra ID P2 or Microsoft Entra ID Governance (P2 is in Microsoft 365 E5 and EMS E5). Without one of these licences PIM shows the alert 'The organization doesn't have Microsoft Entra ID P2 or Microsoft Entra ID Governance'. Access reviews of Microsoft Entra roles run in PIM; the wider access review features need ID Governance or the Microsoft Entra Suite.

Why it matters

Admin roles pile up after projects end. PIM access reviews let you review Microsoft Entra role assignments one time or weekly, monthly, quarterly, semi-annually or annually, and remove access automatically when reviewers deny it or do not respond. The PIM security alert 'Roles are being assigned outside of Privileged Identity Management' has High severity and catches standing assignments added straight in the admin center.

Steps

  1. Open ID Governance > Privileged Identity Management > Microsoft Entra roles > Access reviews > New. Scope: the privileged roles from PA01; frequency Quarterly; duration 14 days.
  2. Reviewers: Selected users (the IT lead and a second reviewer), not Members (self) for Tier 0 roles.
  3. Upon completion: Auto apply results to resource = Enable; If reviewers don't respond = Remove access. Keep the two emergency access accounts out of scope or approve them every time.
  4. In PIM > Microsoft Entra roles > Alerts > Settings, confirm 'Roles are being assigned outside of Privileged Identity Management' is on with email, and set 'There are too many Global Administrators' and 'Potential stale accounts in a privileged role' to match the PA01 targets.
  5. Put the review dates in the team calendar and track each quarter's result in the tracker.

Impact on users

Reviewers spend a few minutes per quarter. Admins whose role is not approved lose it at the end of the review; they can request it again through PIM.

Rollback

Stop or delete the review definition before it ends, or set Auto apply to Disable and apply results by hand. Removed eligible assignments can be added again in PIM.

Read-only check

Reads settings only. It changes nothing in your tenant or on the device.

Modules, connection and role 
Requires: Microsoft.Graph PowerShell SDK (Microsoft.Graph.Identity.Governance, .Users, .DirectoryObjects, .Authentication).
Connect first:
Connect-MgGraph -Scopes RoleManagement.Read.Directory,RoleManagementPolicy.Read.Directory,AccessReview.Read.All,User.Read.All,Directory.Read.All
Role: Global Reader is normally enough. If a PIM read is denied, run it as Privileged Role Administrator: the script still only reads.

Get-MgIdentityGovernanceAccessReviewDefinition -All | ForEach-Object { "$($_.DisplayName) | status: $($_.Status) | recurrence: $($_.Settings.Recurrence.Pattern.Type) every $($_.Settings.Recurrence.Pattern.Interval) | auto-apply: $($_.Settings.AutoApplyDecisionsEnabled) | if no response: $($_.Settings.DefaultDecision)" }
"No output above = no access review definitions. PIM alert settings are portal-only (see Verify)."

How to verify

PA05 lists a privileged-role review with recurrence absoluteMonthly every 3, auto-apply True and default decision Deny. In PIM > Alerts the 'assigned outside of PIM' alert is on and its email reaches the security mailbox.

Sources

This control is in the Privileged Access and PIM Kit

The free Top 5 has this control with its Jira import, Excel project plan, tracker CSV and the read-only PowerShell script.

Download the free Top 5 See the kit