# Reduce SaaS waste with Entra access reviews Use Microsoft Entra access reviews and entitlement management to find unused SaaS access, schedule recertification, and remove stale accounts before renewal. Canonical page: https://mosheldon.com/blog/reduce-saas-waste-with-entra-access-reviews/ Author: OpenTech Consulting Published: 2026-10-21T12:00:00Z Updated: 2026-10-21T12:00:00Z If you need to cut SaaS waste without buying another optimization tool, start by reviewing who still needs access and removing what they no longer use. Microsoft Entra access reviews are built for that job: they let you ask users or owners to recertify access, then remove access after the review is complete [Microsoft Learn](https://learn.microsoft.com/en-us/entra/id-governance/manage-user-access-with-access-reviews). That makes them useful for small businesses, schools, and IT teams that manage shared apps, departments, contractors, and guest access. The practical goal is simple: identify unused access, review it on a schedule, and remove it before renewal or offboarding. Microsoft’s guidance also notes that excessive access can create security risk and audit findings, so this is both a cost-control and governance task [Microsoft Learn](https://learn.microsoft.com/en-us/entra/id-governance/access-reviews-overview). ## Why access reviews help with SaaS waste SaaS waste usually shows up in one of three ways: people keep access after changing roles, groups keep members after the project ends, or access package assignments remain active after the work is done. Microsoft Entra access reviews are meant to periodically confirm that users still need access to groups, enterprise applications, and role assignments [Microsoft Learn](https://learn.microsoft.com/en-us/entra/id-governance/access-reviews-overview). Microsoft also documents system recommendations that can make reviews easier to complete. For example, inactive-user recommendations mark a user as inactive if they have not signed into the tenant within the last 30 days, and for application assignments the check is based on app activity rather than tenant-wide activity [Microsoft Learn](https://learn.microsoft.com/en-us/entra/id-governance/review-recommendations-access-reviews). Those recommendations are evaluated when the review starts, so they are a starting point for decision-making, not a live activity feed. For organizations with bundled SaaS access, entitlement management adds another layer. Microsoft says you can enable periodic reviews of users with active access package assignments to reduce stale access, and you can set separate review schedules for different assignment policies [Microsoft Learn](https://learn.microsoft.com/en-us/entra/id-governance/entitlement-management-access-reviews-create). ## A simple workflow you can run every quarter Start with a short list of resources that are expensive, sensitive, or both. Good candidates are department groups tied to a major SaaS product, guest-heavy collaboration spaces, and access packages that grant multiple app permissions. Microsoft supports reviews for groups, applications, and access packages, so you do not need a different process for each one [Microsoft Learn](https://learn.microsoft.com/en-us/entra/id-governance/access-reviews-overview). A practical quarterly workflow looks like this: 1. Pick one SaaS app or one access package first. 2. Choose the reviewer who actually owns the resource: the user, a manager, a group owner, or another specific reviewer. 3. Set a short review period and a clear end date. 4. Turn on reminders so reviewers are nudged before the review closes. 5. Apply the decision at the end of the review so denied access is actually removed. Microsoft’s access review documentation says reviewers can be the users themselves or another decision maker, that reviewers receive email links to the access panel, and that reminders can be sent automatically if they have not responded [Microsoft Learn](https://learn.microsoft.com/en-us/entra/id-governance/manage-user-access-with-access-reviews). The same guidance says you can stop the review and apply the changes after reviewers give input. If you use entitlement management, Microsoft lets you define recurring access reviews as monthly, quarterly, bi-annually, or annually, and you can choose whether reviewers are self-reviewers, specific reviewers, or managers with fallback reviewers [Microsoft Learn](https://learn.microsoft.com/en-us/entra/id-governance/entitlement-management-access-reviews-create). For many small teams, quarterly is a reasonable starting point because it gives you enough time to gather evidence without letting access drift for a full year. ## What to verify before you remove access The value of a review depends on whether the decision is well grounded. Before you remove access, verify three things: the user still needs the app, the app is tied to a current business purpose, and the decision will not break a process that lacks a backup. Use these checks: - **Activity check:** If Entra’s review recommendations show a user as inactive, confirm whether that means truly unused access or simply a quiet period in a seasonal role [Microsoft Learn](https://learn.microsoft.com/en-us/entra/id-governance/review-recommendations-access-reviews). - **Business-owner check:** Ask the group or app owner to confirm the access still supports a current job, class, or project. - **Exception check:** If an account is left in place as a temporary exception, set a new review date and document the reason. Microsoft notes that access reviews can be used to maintain exception lists and to confirm guests still need access to sensitive content [Microsoft Learn](https://learn.microsoft.com/en-us/entra/id-governance/access-reviews-overview). That matters because guest users and project users are often where unused access accumulates fastest. There is one tradeoff to keep in mind: automated recommendations can speed decisions, but they should not replace context. Microsoft’s inactive-user recommendation is based on sign-in or app activity, not on whether the person still has a legitimate one-off business reason to keep access [Microsoft Learn](https://learn.microsoft.com/en-us/entra/id-governance/review-recommendations-access-reviews). In practice, that means the recommendation should inform the review, not replace the reviewer. ## License and scope questions to settle early Microsoft says access reviews require Microsoft Entra ID P2 or Microsoft Entra ID Governance, and some capabilities require Microsoft Entra ID Governance or Microsoft Entra Suite subscriptions [Microsoft Learn](https://learn.microsoft.com/en-us/entra/id-governance/manage-user-access-with-access-reviews). Microsoft also notes that certain features, such as creating a review on inactive users or using user-to-group affiliation recommendations, require a Microsoft Entra ID Governance license [Microsoft Learn](https://learn.microsoft.com/en-us/entra/id-governance/access-reviews-overview), [Microsoft Learn](https://learn.microsoft.com/en-us/entra/id-governance/review-recommendations-access-reviews). Because Microsoft’s licensing pages can change and tenant licensing can vary by feature, check your edition and entitlement before you design the process. Do not assume every review type is covered by the same license. If you only need a basic quarterly recertification of a group or app, that may be simpler than using advanced recommendation-based review features. If you need bundles of SaaS access with expirations and recurring review cycles, entitlement management may fit better than standalone group reviews [Microsoft Learn](https://learn.microsoft.com/en-us/entra/id-governance/entitlement-management-access-reviews-create). ## Make the review part of renewal and offboarding Access reviews work best when they are tied to a calendar event you already manage. For example, schedule a review 30 to 60 days before a SaaS renewal so the results can feed the renewal decision. If the review shows that a department still has 40 assigned users but only 25 are active, that is a signal to recheck licensing and business need before you extend the contract. The same logic applies to offboarding. Access reviews should not replace lifecycle processes, but they can catch residual access that a move, leave, or guest exit missed. Microsoft’s guidance specifically frames access reviews as a way to ensure only the right people have continued access and to remove access when the review ends [Microsoft Learn](https://learn.microsoft.com/en-us/entra/id-governance/manage-user-access-with-access-reviews). For most small organizations, the best first step is not a big platform project. It is a repeatable review cycle with one owner, one schedule, and one cleanup step. Start with the most expensive or sensitive SaaS app, use Entra’s review reminders and recommendations, verify the edge cases, then remove the access that no longer has a real business purpose. That gives you a practical way to reduce waste without adding unnecessary process. ## Related guidance [Explore related guides](https://mosheldon.com/topics/cloud/) · [Discuss implementation support](https://mosheldon.com/services/). ## Sources and references - [Manage user access with Microsoft Entra access reviews - Microsoft Learn](https://learn.microsoft.com/en-us/entra/id-governance/manage-user-access-with-access-reviews): Core workflow for creating and performing access reviews, including reviewer assignment, reminders, and applying removals after review. - [What are access reviews? - Microsoft Entra ID Governance](https://learn.microsoft.com/en-us/entra/id-governance/access-reviews-overview): High-level explanation of why access reviews matter and where they fit in identity governance; useful for framing the problem and business rationale. - [Review recommendations for Access reviews - Microsoft Entra ID Governance](https://learn.microsoft.com/en-us/entra/id-governance/review-recommendations-access-reviews): Shows system-based recommendations, including inactive-user recommendations, which is directly relevant to finding unused access before SaaS renewal. - [Create an access review of an access package in entitlement management - Microsoft Entra ID Governance](https://learn.microsoft.com/en-us/entra/id-governance/entitlement-management-access-reviews-create): Documents how to create access reviews for access packages, which helps govern bundles of SaaS access rather than only individual groups.