> ## Content Index
> Fetch the complete content index at: https://www.myronhelgering.com/llms.txt
> Use this file to discover other available public pages before exploring further.

# Manage Conditional Access exclusions with Access Reviews
- URL: https://www.myronhelgering.com/manage-conditional-access-exclusions-with-access-reviews/
- Published: 2023-04-27T18:57:10.000Z
- Updated: 2026-10-17T15:53:56.000Z
- Author: Myron Helgering
- Tags: Blog Posts, Microsoft Entra

Today, I'm following up on a [recent blog post](https://www.myronhelgering.com/manage-conditional-access-exclusions-with-pim/) where I talked about how to manage Conditional Access exclusions with PIM. For a similar purpose we are going to utilize the Access Reviews feature, which is part of the Identity Governance solution available in Microsoft Entra.

Access Reviews are a useful tool that helps to ensure the right people have access to the correct applications, admin roles, or group memberships. When used effectively, Access Reviews can minimize excessive access in your environment for both employees and guests.

When it comes to Conditional Access exclusions, IT often struggles to keep track of the list of excluded users. After a user has been excluded for more than a few months, it's likely that no one remembers why they were added in the first place. This is where Access Reviews come in, allowing us to manage these exclusions, provide insight into account activity, and automatically remove exclusions.

Beyond managing Conditional Access exclusions, Access Reviews can also be used to;

- Manage members or guests membership in Microsoft Teams.
- Manage permissions for SharePoint sites.
- Manage access to enterprise applications.
- Manage eligible or permanent administrative roles in Azure or M365.
- Manage other policy exclusions in for example Microsoft Intune.

In this blog post I am going to show you how you can manage Conditional Access exclusions with Access Reviews and it will include the following sections;

- [Scenario](#scenario)
- [Licensing and roles](#licensing-and-roles)
- [Prepare Conditional Access policy](#prepare-conditional-access-policy)
- [Create Access Review](#create-access-review)
- [User Experience](#user-experience)
- [Conclusion](#conclusion)

## Scenario

For this particular scenario, the company has implemented a simple Conditional Access policy that requires MFA for all users. To manage the exclusions for this policy, they have created a security group, allowing members of the group to bypass the MFA requirement.

However, after a few of months, the Security Officer has become concerned about the number of users being excluded from MFA and the potential security risks this poses. When the Security Officer (Albus) asks one of the IT employees (Draco) why the users have been excluded, the IT employee admits that some of the users have been excluded for such a long time that he is no longer certain.

To help the Security Officer effectively manage these exclusions, we will configure a recurring monthly Access Review and require a justification for each exclusion.

## Licensing and roles

To meet the licensing requirements for this scenario, you will need the following;

- Azure Active Directory Plan 1; for all users assigned to a Conditional Access policy.
- Azure Active Directory Plan 2; for all users performing Access Reviews.

To be able to create Access Reviews, you'll also need one of the following roles;

- User Administrator
- Identity Governance Administrator
- Privileged Role Administrator (for role-assignable groups only)

## Prepare Conditional Access policy

To follow along, ensure that you have created a Security Group and added it as an exclusion to your Conditional Access policy. We will be using the same policy and group displayed in the picture below.

![CA Policy with exclusion group](https://storage.ghost.io/c/50/f8/50f86270-efcb-4a24-a4c4-13c44e3209ab/content/images/2026/10/ca-policy-with-exclusion-group.png)

## Create Access Review

To begin, let's create and configure a new Access Review from the Microsoft Entra admin center.

1. Navigate to the [Microsoft Entra admin center](https://entra.microsoft.com/) \> **Identity Governance** \> **Access Reviews**.
2. Navigate to **Access Reviews** \> and click on **\+ New Access Review**.

![New Access Review](https://storage.ghost.io/c/50/f8/50f86270-efcb-4a24-a4c4-13c44e3209ab/content/images/2026/10/new-access-review.png)

The first page allows us to configure the scope of the access review. For example, we can choose whether we are reviewing access for applications, teams, and groups, or which users or guests we want to include.

1. Select **Teams + Groups**.
2. Set the Review scope to **Select Teams + groups**.
3. Select the "Security Group" that is used for Conditional Access exclusions.
4. Set the scope to **All users**.
5. Click **Next: Reviews**.

![Access Review Type](https://storage.ghost.io/c/50/f8/50f86270-efcb-4a24-a4c4-13c44e3209ab/content/images/2026/10/access-review-type.png)

On the second page, we can configure who will perform the review and when it will take place.

1. Optionally, you can set up multiple stages for the Access Review, with a maximum of three stages.
2. Select **Selected user(s) or group(s)**.
3. Choose the "users or user groups" who will be responsible for reviewing the Conditional Access exclusions. In my example, I have selected the highly responsible IT employee, Draco.
4. Specify the "Duration of the Access Review (in days)", which specifies the amount of time reviewers have to complete the review. In my example, I've set the duration to **7 days**.
5. Select the Review recurrence, for my example I chose for a **Monthly** review.
6. Choose the Start date of this Access Review.
7. Select the End date, which I set to **Never**.
8. Click **Next: Settings**.

![Access Review Reviews](https://storage.ghost.io/c/50/f8/50f86270-efcb-4a24-a4c4-13c44e3209ab/content/images/2026/10/access-review-reviews.png)

On the third and final configuration page, we will configure the Access Review settings, which includes setting up notifications, justifications requirements and how to handle review results.

1. Select **Auto apply results to resource** to automatically remove the exclusions after the Access Review.
2. Decide what will happen "If reviewers don't respond". I will select **No change** option, because removing valid exclusions could have negative consequences such as the malfunctioning of applications or the breaking of automated tasks.
3. Choose whether to send a notification at the end of the review. I decided to notify our Security Officer, Albus, as he will be interested in knowing the outcome of the Access Reviews.
4. Select **No sign-in within 30 days** to present information about inactive users to the reviewer. This information could help determine if exclusions are still necessary.
5. Select **Justification Required** to make sure reasons for approval are logged for auditing purposes.
6. Select **E-mail Notifications** to make sure reviewers know when it is time to review.
7. Select **Reminders** to remind reviewers that they still have an active access review to finish.
8. Supply some extra context as to why this Access Review needs to be completed.
9. Click **Next: Review + Create** \> give the Access Review a name and click **Create**.

![Access Review Settings](https://storage.ghost.io/c/50/f8/50f86270-efcb-4a24-a4c4-13c44e3209ab/content/images/2026/10/access-review-settings.png)

After configuring the Access Review, we can now wait for the recurring review to begin. In our example, we started the review today, so let's see what we have set in motion.

## User Experience

Our trustworthy IT employee, Draco receives an e-mail requesting him to review the Conditional Access policy exclusions. Upon clicking the **Start Review** button, he is redirected to the [myaccess](https://myaccess.microsoft.com) page, where he can perform the Access Review.

![Access Review E-mail](https://storage.ghost.io/c/50/f8/50f86270-efcb-4a24-a4c4-13c44e3209ab/content/images/2026/10/access-review-email.png)

Draco is presented with a list of excluded users from the Conditional Access policy, and must choose to either approve or deny their membership access to the security group. Additionally, he notices a "Recommendation" for the Service\_MigrationApp account, indicating that this user has not logged in recently.

![Access Review User Experience](https://storage.ghost.io/c/50/f8/50f86270-efcb-4a24-a4c4-13c44e3209ab/content/images/2026/10/access-review-user-experience.png)

Draco provides justifications for each user in the list as he makes a decision for them.

![Access Review User Experience 2](https://storage.ghost.io/c/50/f8/50f86270-efcb-4a24-a4c4-13c44e3209ab/content/images/2026/10/access-review-user-experience-2.png)

![Access Review User Experience 3](https://storage.ghost.io/c/50/f8/50f86270-efcb-4a24-a4c4-13c44e3209ab/content/images/2026/10/access-review-user-experience-3.png)

![Access Review User Experience 4](https://storage.ghost.io/c/50/f8/50f86270-efcb-4a24-a4c4-13c44e3209ab/content/images/2026/10/access-review-user-experience-4.png)

After the Access Review, which we set to run for a duration of 7 days, has been completed, any user who was denied access will be automatically removed from the security group. This ensures that the Multi-Factor Authentication CA policy is enforced again for these users.

After the Access Review has been completed, an email will be sent to our Security Officer, Albus, notifying him of the completion of the review.

![Access Review Complete](https://storage.ghost.io/c/50/f8/50f86270-efcb-4a24-a4c4-13c44e3209ab/content/images/2026/10/access-review-complete.png)

When he checks the results of the monthly Access Review, he discovers that Draco has approved his own exclusion.

![Access Review exclusions check](https://storage.ghost.io/c/50/f8/50f86270-efcb-4a24-a4c4-13c44e3209ab/content/images/2026/10/access-review-check-1.png)

After reviewing the audit details, Albus determines that Draco provided a non-valid reason for his exclusion, and as a result, he can take the appropriate actions.

![Access Review Audit log check](https://storage.ghost.io/c/50/f8/50f86270-efcb-4a24-a4c4-13c44e3209ab/content/images/2026/10/access-review-audit-log-check-1.png)

## Conclusion

In my experience Access Reviews can be an efficient method to manage Conditional Access exclusions. When combined with [just-in-time exclusions with Privileged Identity Management](https://www.myronhelgering.com/manage-conditional-access-exclusions-with-pim/), you will probably reduce the amount of exclusions significantly. Even though we may not be able to completely eliminate them, at least we can be sure that each exclusion has a valid reason and we can work towards reducing the amount constantly.

# Manage Conditional Access exclusions with Access Reviews