Review Microsoft Entra Guest Access with Access Reviews

This guide creates a one-time review for guest membership in a single Microsoft Entra group. Reviewers decide whether each guest still needs access; the administrator checks the decisions before applying them.

Use a group whose membership can be changed here

For this removal workflow, choose a cloud-managed group with assigned membership and direct guest members. Reviews cannot directly remove members from an on-premises synchronized group, and dynamic membership is controlled by its rule. Route those results to the group’s source owner instead; also review access granted through nested groups or other assignments. See Microsoft’s access reviews deployment guidance.

Start with one approved group and manual application

An access review can remove a guest from a resource, and some configurations can block sign-in or delete a guest account from the tenant. Begin with one approved group, leave automatic application off for the first review, and do not select tenant-account deletion unless that separate action has been explicitly reviewed and approved.

Licensing and review scope

Basic access reviews are available with Microsoft Entra ID P2 or Microsoft Entra ID Governance. License the relevant member administrators and reviewers according to the selected features. Guest licensing uses a different model: basic P2 actions are not billed to the Governance guest add-on, while Governance-only features such as inactive-user reviews or machine-learning recommendations can require linked Azure billing and incur guest MAU charges. Verify Microsoft’s current guest licensing guidance before selecting those features. This review covers one group, not every permission a guest may have elsewhere.

01

Select the Resource and Accountable Reviewers

Preflight

Choose one Microsoft Entra security group or Microsoft 365 group that contains guest users and has an accountable owner. Confirm the group is the correct resource, the owner can make access decisions, and the review population is limited to guest accounts. Check current licensing and decide who will review each guest; the group owner or a responsible sponsor is usually closer to the business need.

Resource to review:
Group owner or business sponsor:
Guest population confirmed:
Review administrator and reviewer licenses confirmed:
Review window and change owner:

❯ Illustrative Output (Results Vary)

The review has one known resource owner and a clearly bounded guest population.

---

02

Create a Guest-Only Access Review

Review Setup

In the Microsoft Entra admin center, open ID Governance > Access Reviews > New access review. Select the group or team review option, choose only the approved group, then set the review scope to Guest users only. Give the review a name that identifies the resource and review period, such as Guest review - project group - Q4 pilot.

Review type: Teams + groups
Scope: one approved group
Users to review: Guest users only
Review name: resource and period are identifiable

❯ Illustrative Output (Results Vary)

The preview lists guest members of the selected group, not all tenant users.

---

03

Set Reviewers, Duration, and Completion Behavior

Review Controls

Choose the group owner, a responsible sponsor, or the guests themselves as reviewers. Set a review duration and start date that give reviewers enough time to confirm each business need. For this first review, turn off Auto apply results to resource and choose No change for users who receive no decision. This preserves current access until the review owner checks incomplete decisions.

Reviewers: accountable group owner or named sponsor
Duration and start date: approved review window
Recurrence: one-time for this pilot
Auto apply results to resource: off
If reviewers don't respond: No change

❯ Illustrative Output (Results Vary)

Unreviewed guests retain current access until an administrator reviews the results.

Automatic removal can affect users when reviewers do not respond

If automatic application is enabled with a “Remove access” or recommendation-based no-response rule, missing reviewer decisions can remove access. Keep manual application during the first cycle and assign a backup reviewer or owner before starting.

---

04

Start the Review and Collect Decisions

Reviewer Action

Review the settings and start the access review. Reviewers receive a notification with a link to the review. Ask them to evaluate each guest against a current business owner, project, or sponsorship record; they should approve continued access only when there is a clear need. Record the reason for each denial and follow up on items marked not reviewed.

For each guest:
  Confirm a current business sponsor and reason for access.
  Approve only when continued access is justified.
  Deny when access is no longer needed.
  Escalate unknown or incomplete cases to the resource owner.

❯ Illustrative Output (Results Vary)

Review progress shows decisions, pending reviewers, and guests not yet reviewed.

---

05

Inspect Decisions Before Applying Them

Administrator Review

Open the completed review under ID Governance > Access Reviews. Check the decision, reviewer, and justification for every guest. Resolve “Not reviewed” and ambiguous results with the resource owner. Stop the review when it is complete, then use the review’s Apply results action only after the decisions are approved.

Validate each denied decision with the group owner.
Follow up on not-reviewed guests; do not assume they should be removed.
Stop the review when the agreed review window is complete.
Apply results only after the owner signs off.

❯ Illustrative Output (Results Vary)

Only reviewed and approved decisions are applied to the selected resource.

---

06

Confirm the Resource Change and Plan the Next Review

Validation

Check the group’s membership after the results are applied and confirm that each removal matches an approved denial. Removing a guest from this group does not remove access the same guest receives through other groups or applications. Document the outcome, assign an owner for remaining decisions, and schedule the next review interval if the resource requires recurring certification.

Denied guests removed from the reviewed group:
Approved guests remain members:
Not-reviewed guests routed to an owner:
Other resource access considered separately:
Next review owner and date:

❯ Illustrative Output (Results Vary)

The reviewed group reflects its approved decisions, and unresolved access remains assigned to an owner.

Upstream references

See Microsoft’s manage guest access with access reviews, create an access review for groups and applications, complete an access review, and access review licensing requirements.