Access review
A periodic check that everyone who holds access to something still needs it.
Access accumulates silently, and nothing removes it automatically. Reviews are the correction: managers or resource owners confirm each person still requires what they hold, and anything unconfirmed is revoked.
Auditors ask for evidence of these under most frameworks. Doing them quarterly for privileged access and annually for everything else is a defensible baseline.
Where this comes up
Access review sits inside our identity and access work. If you are trying to work out what this means for your own environment rather than in the abstract, that is the page worth reading next, and a short call will get you a straight answer faster than either.
Related terms
Least privilege Giving every account only the access it needs to do its job, and nothing beyond that. Role-based access control Granting permissions to roles rather than individuals, and assigning people to roles. Entra ID P2 The premium Entra licensing tier, adding Identity Protection, Privileged Identity Management, and access reviews. Joiner, mover, leaver The three lifecycle events that should trigger changes to someone's access, handled as a defined process.