Entra access reviews without P2: a CSV method

What Entra access reviews do, and what they need

An Entra access review runs on a schedule, "weekly, monthly, quarterly or annually" (access reviews overview). Reviewers get an email when the review starts and a reminder halfway through, and with auto-apply turned on, denied users lose access when the review ends (create an access review). Each reviewer answers Approve, Deny or Don't know (perform a review), and Entra can recommend Deny for anyone who has not signed in within 30 days (review recommendations).

Microsoft now files access reviews under Microsoft Entra ID Governance. The review features that were generally available in Entra ID P2 still work with P2. Newer ones, such as reviews scoped to inactive users and user-to-group affiliation recommendations, need a Governance license. Licenses are needed for everyone involved, "including for all employees who are reviewing access or having their access reviewed" (ID Governance licensing fundamentals).

US list prices, per user per month on a yearly plan: P1 $7, P2 $10, the ID Governance add-on $7 on top of P1 or P2, and Entra Suite $12 (Entra pricing). P1 and P2 rose from $6 and $9 on July 1, 2026 (Microsoft licensing news). Microsoft 365 Business Premium and E3 include P1; E5 includes P2. So the most common small-company setup, Business Premium, has P1 and no access reviews. At the $10 list price, standalone P2 for 50 people is $500 a month; if you already pay for P1, ask your reseller for the add-on price.

What you can export without P2

The reviews need the license. The raw material does not: the download pages below list no P2 requirement. Pull everything on the day the review opens, and keep each file with the time and the page it came from, because that export is the population an auditor samples from.

• Users. In the Microsoft Entra admin center: Users, All users, Download users. Microsoft notes that "both admin and standard users can download user lists" (download a list of users).
• Group membership. Groups, open the group, Members, Download members, also under Bulk operations (download group members). Do this for every group that grants access to something in scope: app access groups, VPN, file shares and admin groups.
• Admin roles. Roles and administrators, All roles, Download assignments, which exports "all active role assignments across all roles" (bulk operations). Admin roles belong in every quarter's review.
• Enterprise app assignments. There is no download button yet; Microsoft says support for enterprise applications "will be added in a future update" (same page). Use PowerShell for these.

Microsoft Graph PowerShell covers app assignments and last sign-in dates. Run it signed in as an admin; the scopes are read-only:

Connect-MgGraph -Scopes "Application.Read.All","User.Read.All","AuditLog.Read.All"

# Who is assigned to one enterprise app (replace Payroll with the app's name)
$sp = Get-MgServicePrincipal -Filter "displayName eq 'Payroll'"
Get-MgServicePrincipalAppRoleAssignedTo -ServicePrincipalId $sp.Id -All |
  Select-Object PrincipalDisplayName, PrincipalType, AppRoleId, CreatedDateTime |
  Export-Csv payroll-assignments.csv -NoTypeInformation

# Last sign-in for every user (needs Entra ID P1 or P2)
Get-MgUser -All -Property displayName,userPrincipalName,signInActivity |
  Select-Object DisplayName, UserPrincipalName,
    @{n='LastSignIn'; e={$_.SignInActivity.LastSignInDateTime}} |
  Export-Csv last-sign-in.csv -NoTypeInformation

Three things to check in the output. A PrincipalType of Group means everyone in that group has the app, so export the group's members too. AppRoleId maps to a role name in the app's AppRoles list, and an ID of all zeros means default access. And the sign-in date needs "a Microsoft Entra ID P1 or P2 license and the AuditLog.Read.All permission" (Graph user resource), so Business Premium and E3 tenants get it and free tenants do not. On the free tier, the sign-in log is kept for seven days, against 30 on P1 or P2 (data retention), so look there on the day you open the review rather than when someone asks.

Turn the exports into one review

• One row per user per access. Columns: user, entitlement (the group, role or app role), reviewer, a one-line description of what the entitlement allows, and last sign-in. The template has the exact columns.
• One reviewer per row. The manager for business apps, the system owner for admin roles, and nobody reviews their own access.
• Short lists, three answers. Each reviewer sees only their rows and answers keep, revoke or don't know. A "don't know" is the honest answer for an entitlement nobody described, and it is cheaper than a blind keep.
• Remove access yourself, and write it down. Without auto-apply, every revoke is a manual change in Entra. Record the date and who made it. A revoke with no recorded follow-through leaves a record showing you knew and did not act.
• File it together. The exports, the decisions and the removal record go in one folder per quarter, named the same way every time.

What you lose, and what you keep

The CSV route costs you the automation: Microsoft's schedule, the reviewer emails, the 30-day sign-in recommendation and auto-apply. Auto-apply matters less in hybrid tenants than it sounds, because it does not remove access from groups synced from on-premises Active Directory or from dynamic groups (complete an access review). Those changes are made by hand either way.

It does not cost you the record. The evidence is who reviewed which access, when, what they decided, whether the removals happened, and whether the review ran on the cadence your policy states (more in what auditors ask for in an access review). A CSV review produces all of that if you keep the exports, the decisions and the removal log.

P2 is the better buy if you already have it through E5, or if you review dozens of groups every quarter and want removals applied for you. The CSV route fits tenants where a seat for everyone reviewed and reviewing costs more than the hours it would save.

Questions

Does Microsoft 365 Business Premium include access reviews?

No. Business Premium includes Entra ID P1. Access reviews need Entra ID P2 or Microsoft Entra ID Governance licenses.

Can we review Entra admin roles without P2?

Yes, by hand: download the role assignments, have someone other than the role holder confirm each one, and remove what is no longer needed. Reviews of roles inside Privileged Identity Management need P2 or Governance licenses, like PIM itself.

Will an auditor accept a review run from exports and a spreadsheet?

That is a judgment for you and your auditor, and we do not give audit advice. One practitioner on r/soc2 summed up the usual ask: "the auditor wants to see who reviewed, when, what the outcome was, and that it happens on a defined cadence" (r/soc2). An export-based review can show all four.

Next step

Everything above works with the exports and a spreadsheet. If you would rather not run the split and the chasing by hand, AttestProof runs the review from the same CSV. The import asks which column holds the user, the entitlement and the reviewer's email; description and last login are optional. Each reviewer gets a link to their own rows, with no account, and marks every row Keep, Revoke or Don't know; keeping all remaining rows at once needs a typed justification. Closing the review produces the evidence pack.

What it does not do: connect to Entra or any other identity provider, or remove anyone's access. You export the list, an admin makes each change in Entra, and the review records that it was done. If you already own Entra ID P2 or another platform with working access reviews, use that. Email invites and reminders start on the $29-a-month Starter plan; on Free you copy the reviewer links yourself. The help page walks through a first review, and the plans are on the pricing page.