Where to create each type of access review
Verdict: Entra role reviews live in PIM. Group membership reviews live in access reviews or Entra groups. Access package reviews live in entitlement management. Blocked consent goes through the admin consent workflow.
| Criterion | Access reviews / Entra groups | Privileged Identity Management | Enterprise applications | Entitlement management | Admin consent workflow |
|---|---|---|---|---|---|
| Reviews or handles | Security and M365 group membership | Microsoft Entra role assignments | Enterprise app assignment | Access package assignments | Blocked user consent requests |
| Example | Recertify group members | Quarterly Global Admin recertification | App access recertification | Package assignment recertification | Finance app permission request |
Rules
- Reviews of Microsoft Entra role assignments, such as Global Administrator, are created in Privileged Identity Management.
- Security group and Microsoft 365 group membership reviews are created in access reviews or Microsoft Entra groups.
- Access package assignment reviews are created in entitlement management.
- The admin consent workflow lets a blocked user submit a justified request for admin approval.
Traps
- The general access reviews blade does not cover Microsoft Entra role assignments; use PIM.
- Permission classifications label impact; they do not create a user request workflow.
- Access reviews recertify existing assignments; they do not handle an initial consent request.