Access Review Health

The question it answers: Which access reviews are overdue, have items nobody decided, or are set up so that their decisions change nothing?

An access review only removes access when reviewers answer and the decisions are applied. Overdue reviews, items nobody decided, and reviews configured without auto-apply or a default decision look like governance on paper but change nothing.

Note

Only the latest instance of a recurring review is checked. Reviews of guests in all Microsoft 365 groups can have thousands of decisions - reading them takes a while on the first load.

At a glance

Where in the app	Entra ID › Identity Lifecycle › Access Review Health
Workload	Entra ID
Kind	Table
Data	Built from the tenant data IntensiveReports keeps in memory and refreshes in the background, so it opens at once.
Licence	Microsoft Entra ID P2 or Microsoft Entra ID Governance.
Report id (API and MCP)	entra.lifecycle.access-review-health

Columns

Column	Key	Type
Review	DisplayName	Text
Findings	Findings	Status
Latest run	InstanceStatus	Text
Ends	InstanceEnd	Date
Not reviewed / items	NotReviewed	Text
Auto-apply	AutoApply	YesNo
Default decision	DefaultDecision	Text
Recurrence	Recurrence	Text
Scope	Scope	Text

Filters

Filter	Key (API)	On when the page opens
Only reviews that need attention	attention	Yes

What it needs

Licence: Microsoft Entra ID P2 or Microsoft Entra ID Governance.

Application permissions on the IntensiveReports app registration (all permissions):

Permission	API	What it allows	Note
AccessReview.Read.All	Microsoft Graph	Read all access reviews

Data sources it reads

• GET /v1.0/identityGovernance/accessReviews/definitions
• GET .../definitions/{id}/instances
• GET .../instances/{id}/decisions

Through the API and MCP

GET /ir-api/v1/reports/entra.lifecycle.access-review-health?size=100
GET /ir-api/v1/reports/entra.lifecycle.access-review-health?filter=attention

An AI assistant reads it with the MCP tool get_report and the id entra.lifecycle.access-review-health. The client needs the Read grant for Entra ID. See Using the API.