# Use Entra access reviews before SaaS renewals Use Microsoft Entra access reviews and entitlement management to remove stale SaaS access before renewals, with a simple process for small IT teams. Canonical page: https://mosheldon.com/blog/use-entra-access-reviews-before-saas-renewals/ Author: OpenTech Consulting Published: 2026-10-29T12:00:00Z Updated: 2026-10-29T12:00:00Z Small IT teams should use Microsoft Entra access reviews before SaaS renewals because they can expose who still has access, who has not used it recently, and which assignments should be removed or re-approved. Microsoft’s guidance says access reviews can be run for groups, applications, and access packages, and can automatically remove access when the review is complete if you choose that outcome [Microsoft Entra access reviews](https://learn.microsoft.com/en-us/entra/id-governance/manage-user-access-with-access-reviews), [What are access reviews?](https://learn.microsoft.com/en-us/entra/id-governance/access-reviews-overview). This matters when renewals are approaching and nobody can confidently answer a basic question: who still needs this app? Stale access is a security problem, but it is also a process problem. If the license owner, business owner, and IT team each assume someone else is checking access, renewals tend to happen on habit instead of evidence. Microsoft’s deployment guidance explicitly recommends planning who will review access, what resources to review, how often to review them, and what should happen when reviewers do not respond [Plan a Microsoft Entra access reviews deployment](https://learn.microsoft.com/en-us/entra/id-governance/deploy-access-reviews). ## Start with the right review target The most practical place to begin is not with every app in the tenant. Start with one or two SaaS applications that are up for renewal soon and already integrated with Microsoft Entra ID, because Microsoft documents application assignments, groups, and access packages as standard review targets [What are access reviews?](https://learn.microsoft.com/en-us/entra/id-governance/access-reviews-overview). For a small IT team, the cleanest sequence is: 1. Pick the renewal date first. 2. Choose the app or access package that creates the most renewal risk. 3. Decide who should review access: the app owner, manager, or specific delegates. 4. Decide whether the review should be self-review or reviewer-led. 5. Decide what happens to nonresponses: no change, remove access, or take recommendations. Microsoft notes that reviewers can be users themselves, managers, or specific reviewers, and that the creator decides this before the review starts [Plan a Microsoft Entra access reviews deployment](https://learn.microsoft.com/en-us/entra/id-governance/deploy-access-reviews). That means you should verify the reviewer list before launch. If the wrong person is assigned, you do not get a second chance after the review begins. For access packages, Microsoft also supports recurring reviews tied to the package assignment policy, with frequencies such as monthly, quarterly, bi-annually, or annually [Create an access review of an access package in entitlement management](https://learn.microsoft.com/en-us/entra/id-governance/entitlement-management-access-reviews-create). That is useful when a contractor, partner, or project group should keep access only while there is an active business reason. ## Build the renewal cleanup process around evidence A good renewal cleanup process is simple enough to repeat and strict enough to trust. Microsoft’s documentation gives the core mechanics, but you still need internal rules. A practical workflow is: - Export or identify the app’s current assignments. - Create the access review. - Ask reviewers to confirm only the access that is still needed. - Use the review results to remove access before the renewal meeting. - Record what was removed and why. - Recheck the app after the change to confirm the cleanup happened. Microsoft’s docs say that when a review finishes, you can apply changes and remove access from users who no longer need it [Manage user access with Microsoft Entra access reviews](https://learn.microsoft.com/en-us/entra/id-governance/manage-user-access-with-access-reviews). They also note that reviewers receive email notifications and reminders by default, and that Microsoft Entra can send a reminder halfway through the review period if reviewers have not responded [Manage user access with Microsoft Entra access reviews](https://learn.microsoft.com/en-us/entra/id-governance/manage-user-access-with-access-reviews). If you want a more structured model, use an access package for the app-related resources and attach periodic reviews to that package. Microsoft says access package assignment policies can define expiration, allow extensions, require approval for extensions, and set periodic reviews [Create an access review of an access package in entitlement management](https://learn.microsoft.com/en-us/entra/id-governance/entitlement-management-access-reviews-create). That helps when you want the review itself to become part of the app’s normal lifecycle instead of a one-time cleanup project. ## Tradeoffs to plan for before you automate removals Automation can save time, but only if the process is stable enough to trust. Microsoft’s guidance makes the tradeoff clear: you can automate review outcomes, but you should plan carefully, especially for manual reviews and pilot runs [Plan a Microsoft Entra access reviews deployment](https://learn.microsoft.com/en-us/entra/id-governance/deploy-access-reviews). Key tradeoffs: - **Self-review vs. owner review:** self-review is faster, but managers or owners may make better business decisions when access is sensitive. - **Auto-apply results vs. manual follow-up:** auto-apply reduces leftover access, but it can remove access that was needed if the business context was unclear. - **Frequent reviews vs. reviewer fatigue:** too many cycles can make people rush through approvals, which reduces quality. - **Broad app review vs. access-package review:** access packages are cleaner for bundled resources, but not every SaaS app is organized that way. Microsoft recommends piloting reviews with a small group and noncritical resources, starting with reviews whose results are not automatically applied [Plan a Microsoft Entra access reviews deployment](https://learn.microsoft.com/en-us/entra/id-governance/deploy-access-reviews). That is a sensible safeguard for small teams, especially if the app has executives, finance staff, or external partners in scope. ## Verify the cleanup before the renewal meeting Do not treat the review report as proof by itself. Verify the result in the app and in Entra after the review closes. At minimum, check three things: - The review status shows the expected number of users reviewed and actions taken. - Users marked for removal no longer have assignments in Microsoft Entra. - The app owner agrees the remaining access matches current business need. Microsoft says access review reports show the number of users reviewed and the actions taken, and that you can view the review status in the Access reviews section for access packages [Create an access review of an access package in entitlement management](https://learn.microsoft.com/en-us/entra/id-governance/entitlement-management-access-reviews-create). Microsoft also recommends monitoring audit logs during a pilot so you can confirm events are properly recorded [Plan a Microsoft Entra access reviews deployment](https://learn.microsoft.com/en-us/entra/id-governance/deploy-access-reviews). For licensing, be careful not to overstate what you have. Microsoft says access reviews require Microsoft Entra ID Governance or Microsoft Entra Suite subscriptions for your organization’s users, while some capabilities may work with Microsoft Entra ID P2 [What are access reviews?](https://learn.microsoft.com/en-us/entra/id-governance/access-reviews-overview). Microsoft also says entitlement management access reviews require Microsoft Entra ID Governance or Microsoft Entra Suite licenses [Create an access review of an access package in entitlement management](https://learn.microsoft.com/en-us/entra/id-governance/entitlement-management-access-reviews-create). Check your edition and license terms before assuming a feature is available everywhere. A practical rule for renewals is straightforward: if you cannot verify continued need, do not renew based only on inertia. Build the review into the renewal calendar, assign one accountable reviewer, and make the final renewal decision from the cleaned-up access list. For a broader process view, see our internal guide on [cutting SaaS spend by reviewing access first](https://mosheldon.com/blog/cut-saas-spend-by-reviewing-access-first/) and the related walkthrough on [using identity reviews to cut SaaS waste before renewal](https://mosheldon.com/blog/use-identity-reviews-to-cut-saas-waste-before-renewal/). If you are also tightening access workflows more broadly, our note on [using Entra workflows and access reviews together](https://mosheldon.com/blog/use-entra-workflows-and-access-reviews-together/) shows how cleanup and lifecycle processes fit together. ## Sources and references - [Manage user access with Microsoft Entra access reviews](https://learn.microsoft.com/en-us/entra/id-governance/manage-user-access-with-access-reviews): Core workflow for running access reviews, recertifying access, and removing access when users no longer need it. - [What are access reviews?](https://learn.microsoft.com/en-us/entra/id-governance/access-reviews-overview): Overview of where reviews can be created, what can be reviewed, and the license requirement for more advanced review scenarios. - [Plan a Microsoft Entra access reviews deployment](https://learn.microsoft.com/en-us/entra/id-governance/deploy-access-reviews): Deployment guidance for deciding what to review, including SaaS applications integrated with Microsoft Entra ID, and operational planning for reviews. - [Create an access review of an access package in entitlement management](https://learn.microsoft.com/en-us/entra/id-governance/entitlement-management-access-reviews-create): How to attach periodic reviews to access packages, plus the stated licensing prerequisite for Microsoft Entra ID Governance or Microsoft Entra Suite.