Start from three lists
Get the staff list, the account list and the admin list, and compare them. Accounts that are not staff, and admins nobody approved, are the findings. Use account-level data only, such as last sign-in date and MFA status, and leave mailbox and file contents alone.
- Staff list: five fields.
- Account list: sign-in date, MFA status, guest or member.
- Admin list: who holds which role, and who approved it.
Know what your licence can do
Licensing text is easy to misread: a learner asking Microsoft Q&A on 12 May 2025 found conflicting text for access reviews and asked which was the source of truth, and a moderator replied that users who are reviewed need a licence as well. Microsoft's licensing page, checked on 12 October 2026, says access reviews need an Entra ID Governance subscription, that some capabilities might work with Entra ID P2, and that Business Premium includes P1. Check your own tenant before you promise a customer a native review.
Use read-only access you can remove
Microsoft describes Global Reader as able to read everything a Global Administrator can but not update anything. Reports Reader reads sign-in and audit reports but has no access to Exchange, so shared mailbox and forward lists come from an export you run, and Google's Reports API has two read-only scopes. Create any role yourself, give it to the named person, and remove it afterwards.
Show what changed since last month
A single report shows a moment. Keep last month's report beside this month's and mark what is new and what is closed, so you can show what you do routinely.
Which paid job fits
The tenant accounts report lists stale accounts, accounts without MFA, admins, guests and forwards from exports you run; the leavers check compares the tenant with your staff list; the device register matches your device-management and finance lists and checks owners against the staff list. The monthly services and the IT hygiene lane repeat the first two every month, and the lane can take the device register as one month's item. None is an audit, gives assurance or promises a certificate, and your admin makes every change.
Sources and limits
- Microsoft Learn: Microsoft Entra licensing Checked 2026-10-12.
- The page (checked 12 October 2026; it shows 'Last updated on 2026-06-18') says Microsoft Entra ID P1 is included in Microsoft 365 Business Premium, and that Entra ID P2 is included in the Microsoft Defender Suite add-ons for Business Premium.
- It says using access reviews requires a Microsoft Entra ID Governance subscription for member users, including everyone reviewing or being reviewed, and that some capabilities might operate with Entra ID P2.
- Its example scenarios count licences for both reviewers and reviewed users, for instance 75 member users plus 1 group owner as reviewer needing 76 licences.
- It says Lifecycle Workflows require a Microsoft Entra ID Governance subscription, and its feature table lists Lifecycle Workflows under Entra ID Governance and the Entra Suite but not under P1 or P2.
- Microsoft Learn: Microsoft Entra built-in roles Checked 2026-10-12.
- Global Reader is described as able to read everything that a Global Administrator can, but not update anything.
- Reports Reader is described as able to read sign-in and audit reports, and Security Reader as able to read security information and reports in Microsoft Entra ID and Office 365. The Reports Reader text adds that holders have no admin permissions to configure settings or to access product-specific admin centers like Exchange.
- On the roles table, Global Reader and Security Reader carry the privileged-role label and Reports Reader does not.
- Google for Developers: Reports API authorization Checked 2026-10-12.
- The Reports API lists two scopes, admin.reports.audit.readonly (view audit reports) and admin.reports.usage.readonly (view usage reports), and both are read-only.
- Microsoft Q&A: access review licensing requirement, possible conflicting data Checked 2026-10-12.
- A learner asked on 12 May 2025 which of two Microsoft sources was the source of truth for who needs a licence in an access review; a moderator replied the next day that reviewed users need a licence even if they are only the subject of the review.