It would be VERY beneficial to apply an Access Review policy to new groups as they are created, eliminating the management overhead of creating new policies AFTER each group created.
Also, if a Access Review Policy could be applied to multiple groups at a time, Access Reviewmanagement overhead would be reduced.33 votes
Good news – we have made more progress on this ask! We started private preview of reviews on all guests in Teams/Office groups. Please fill out this form to be included in the private preview! We look forward hearing your feedback, working together to improve this feature, and sharing more updates with you very soon!
The emails sent to complete an access review have unnecessary additional content (e.g. Microsoft Address) and do not allow addition of more information to help those that receive a message.18 votes
Thanks for the feedback! Good news is that we are working to improve the emails to provide the reviewers the necessary information succinctly. Some of the information you see, the Microsoft logo and address, some are there because of legal reasons. We are actively working on this right now and will provide updates here.
Follow up question for you, what else do you think is unnecessary, and what would you like to see?
Our organization requires Managers to approve access to Applications. Please give the option to require a manager to approve application access via the Access Reviews option.18 votes
Hi Justin, thanks for the feedback! It will definitely be helpful to have managers as the reviewers, there is a “manager” attribute in AAD’s user profile, but it’s currently a string only. We are working to improve the architecture first, then we can leverage the data to automatically assign managers to be reviewers. If you have any more feedback or questions on this, feel free to comment on this thread or email firstname.lastname@example.org.
Expand access reviews to support Azure Subscription and Resources for explicit assigned identity.10 votes
Thanks for the feedback, we have this work in planning.
Access Reviews should let you review guest users access on the directory level. Using a dynamic group with all guest users in it, I should be able to have access reviews DELETE the user from the Azure Active Directory rather than just removing the user from a group.6 votes
Hi Sigurd, thanks so much for the feedback! If you could reach out to me I would love to chat more to understand your use case and have you participate in our private preview of the delete scenario.
I would like to create an access review for ALL Teams to review guest membership so whenever someone adds an external user to their Team the review will occur. Currently I have to tell the access review policy which teams it applies to. Because my users can add their own teams I have to create a manual process to look at new teams and add them to an access review. I'd rather just apply it to the entire application so it happens with every Team that exists.5 votes
Hello all, Good news – we have made more progress on this ask! We started private preview of reviews on all guests in Teams/Office groups. Please fill out this form to be included in the private preview! We look forward hearing your feedback, working together to improve this feature, and sharing more updates with you very soon! bit.ly/ARGuestsInTeamsPP
Would be great if Access Reviews could include the on-prem group Domain Admins, and the Cloud based group GLobal Admins. Right now this is not possible.5 votes
Thank you John for the feedback! My understanding is that you are referring to access reviews of privileged roles in the PIM experience.
In regards to reviewing on-prem group Domain Admins, historically, groups like that were blocked by AAD connecto for not sending them to AAD, so they are filtered out.
For cloud based group Global Admins, you can review global admins in the current PIM experience, these 2 articles should help you get started –
If you have any more questions – feel free to email email@example.com
Access Reviews don't reflect the azure ad recommendation (example: user not logged for last 30 days etc.) for reviewers of 3rd party SaaS applications. Also, will be great to automate the line manager for each user as the access reviewer, as it would help in larger organisations to better manage and speed up the review process4 votes
Thanks for the suggestion! Good news is that both of your asks are on our roadmap! Are you using Log Analytics in AAD? We’re working to integrate with the user login data in log analytics and surface those in our recommendations.
As for line managers as reviewers, does your tenant have the manager attributed populated for your users? Great if you are, because we’re working on pulling that info from the user profile page.
Access for some applications/groups should be approved by the users manager. As the functionality is not available we cannot utilise the promising Access Review tool.4 votes
Thanks for taking the time to give feedback! We have the work to add managers as reviewers in our backlog, will update here once we have a preview to share!
Currently, we do support group owners as the reviewers, would that help with your scenario?
Would this functionality be your only blocker to use access reviews? I would love to know how you review access right now, any timelines you have. Thanks!
There should be a validation message to check the end date before or equal start date.4 votes
Thanks Manli, I have emailed you on 9/11 asking for specifics, could you please check or elaborate on the scenario here? Appreciated!
Only a timer based Access Review is not enough for us.
We have multiple situation we need to trigger review again, including:
1. Based on some user's attributes update, e.g. Manager reporting line changes, Department changes, job role changes
2. Based on usage pattern, e.g. a user haven't use a certain app/resource for last X days.3 votes
Thanks for the feedback! We are working on adding more triggers to kick off access reviews like what you listed in 1!
For 2. we do show user’s sign-in data to the reviewers to help them make the decisions. If a user hasn’t signed in to the tenant in the last 30 days, then the system will recommend denying that user’s continued access. Are you referring to automatically triggering a review on users who have not accessed an app/resource in the last X days?
Introduce the ability to add exceptions when creating Access Reviews
eg. This will allow us to exclude service accounts from the report of accounts that have not logged on in the last 30 days3 votes
Thanks so much for the feedback! Could you clarify what the “report of accounts” you are referring to in the example? Thanks!
Would be great having the opportunity to edit or add a message into the Email sent by Azure.
Eg. When someone has the role membership denied by a role owner, the user should get the email WITH the reason and not just the email saying that the has been removed.
Also would be great allowing the GA's to add a message or create the reminders by themselves AND schedule it.3 votes
Thanks, the team is reviewing this ask!
This is absolutely ridiculous. I am not a computer genius and it seems that is what you have to be to figure it out2 votes
Looking to see is there a way to automate in where access review that just identifies which accounts have not signed in in 60 days?2 votes
This is a great ask! It is on our roadmap to enable policies to find users who are inactive in the last X days. On a related note, we do have a psh scrip that you can run to find guest users who are not part of any group, would you be interested to try it?
Currently I am a owner of multiple Access Reviews. And my name is sent in the e-mail as owner of the Review. I would like an option to remove my name from the mail, and the option to sent the user to the service desk if they have questions about the Review.
What would be even better is the option to customize the e-mail which is sent to the users.2 votes
Thanks for the feedback and I’m glad we are thinking in the same direction! We have a plan to remove the "inviter"’s name in the email and replace it with a help desk link. Question for you, you mentioned that you prefer to have an “option” to send the users to service desk, 1) would this be an internal link specific to your organization, 2) should this be the default behavior, if not, what would you prefer? 3) another idea – would having a “friendly” description displayed to the users (different from the description the IT admin writes when creating the review), with a service desk link pasted in that description solve your problem?
We have two scenario:
1. For internal organization users, we need FTE manager as reviewer
2. For external organization users, we need to have "sponsor" as reviewer.
I already saw there is a feedback on supporting Manager as reviewer which should be fulfill our requirement 1. above.
For requirement 2 above, we need to assign different "sponsor group" as reviewers (instead of individual users hardcode in Access Review)2 votes
Thanks for the detailed feedback! Yes we are working on adding both manager and sponsor groups as reviewers, will update here when we have a preview ready. In the mean time, if you have any more questions or more requirements, please let us know by commenting here!
Debería ser mas fácil de utilizar.2 votes
Gracias por el comentario. Podría darnos más información sobre qué parte de la experiencia es confusa? Algún scenario en específico que está intentando?
We have a challenging situation to manage group owners in Azure Active Directory. If a person leaves organization, his/her identity will be set to "disabled" state. Is there a way automatic emails can be sent to admins notifying Group Owner ID is disabled for all the managed groups?2 votes
Hi Jaya, thanks for the feedback! I’d love to understand your scenario a bit more and loop in the team working on Groups. To clarify your concern – Is the disabling of group owners when they leave the organization affecting the completion of your existing access reviews? Feel free to comment here or email firstname.lastname@example.org directly. Thanks!
We use access reviews to monitor 3rd party Office 365 accounts and licences. The users are in a security groups that assigns the licences. So if they are denied as part of the access review they are removed form the security group so their Office 365 licences are removed.
Is there a way to also delete the user accounts as part of the process1 vote
- Don't see your idea?