user-access-review

An Entra ID access audit evaluates MFA registration, recent sign-in activity, and risk events to identify risky authentication and privileged access. It checks for entitlement misalignment, Tier 0/Tier 1 admin roles, and stale accounts.

Checking Microsoft 365 group membership and license assignments during offboarding involves auditing security and M365 groups while reporting assigned licenses. This process highlights inactive-but-licensed users for reclamation and flags guest access extending beyond intended scope.

Yes, you can review Azure AD sign-in risk events and MFA registration by resolving an identity via any username, UPN, or display-name input. The review collects risk events and produces a structured access report for security alert investigations.

Entra ID access review works for targeted security alert investigations, access requests, and offboarding. It resolves the target identity and collects license assignments, group memberships, and risk events to produce a structured access review report.

To identify inactive but licensed Microsoft 365 users for license reclamation, an access audit reports assigned Microsoft 365 licenses and evaluates last sign-in recency. This highlights inactive accounts with active licenses so you can reclaim them.