CIS.M365.5.3.3 - (L1) Ensure 'Access reviews' for privileged roles are configured
Overview
The Global, Exchange, SharePoint, Teams, Security and Privileged Role Administrator roles each have a recurring access review that is configured as required.
Role assignments accumulate: people change jobs, projects end and temporary access becomes permanent. A recurring review makes the people who know the context confirm who still needs each privileged role, and removes the others.
Each of the six roles needs an active review that covers users and groups, repeats weekly or monthly, gives reviewers 14 days or less, sends notifications and reminders, asks for a justification when approving, applies results automatically, uses the default decision of No change and does not end. Access reviews need Microsoft Entra ID Governance or Microsoft Entra ID P2 licences.
Remediation action
- Sign in to the Microsoft Entra admin center.
- Go to ID Governance > Privileged Identity Management > Microsoft Entra roles > Access reviews and select New.
- Select the review scope Users and Groups, add the role to review (for example Global Administrator) and choose the Assignment type.
- Set the reviewers, a Weekly or Monthly recurrence, a duration of 14 days or less and No end date.
- Under Upon completion settings, turn on Auto apply results to resource and set If reviewers don't respond to No change.
- Under Advanced settings, turn on Require reason on approval, Mail notifications and Reminders, then start the review.
- Repeat for the other roles in the list.
Related links
- Microsoft Entra admin center - Privileged Identity Management
- Create an access review of Azure resource and Microsoft Entra roles in PIM
- Create an access review of groups and applications in Microsoft Entra ID
- CIS Microsoft 365 Foundations Benchmark v7.0.0 - 5.3.3
Test Metadata
| Field | Value |
|---|---|
| Test ID | CIS.M365.5.3.3 |
| Severity | Medium |
| Suite | CIS |
| Product | Entra ID |
| Feature | Identity Governance |
| Area | Privileged access |
| Resource type | DirectoryRole |
| User impact | Low |
| Implementation cost | Medium |
| MITRE ATT&CK | T1078.004 Cloud Accounts |
| Supports benchmark | CIS Microsoft 365 Foundations Benchmark (version 7.0.0), requirement 5.3.3 |
| Benchmark level | L1 |
| Benchmark profiles | E5 Level 1 |
| Supports controls | cis-m365:5.3.3, nist-800-53-r5:AC-6(7) |
| PowerShell test | Test-MtCisPrivilegedRoleAccessReviews |
| Services | Graph |
| Compatible licenses | AAD_PREMIUM_P2, Entra_Identity_Governance |
Source
- Test:
tests/cis/Test.CIS.M365.5.3.3.ps1 - Documentation:
tests/cis/Test.CIS.M365.5.3.3.md