Entra ID Access Reviews for Agencies: Leavers, Shared Accounts, and Monthly Cleanup

At a small agency, Microsoft 365 access often outlives the project. A designer leaves, a social-media shared account keeps working, a client guest stays in a Teams group, and an old admin role still exists because nobody wanted to break production. The first useful screen is not an AI prompt. It is the Entra ID user list, groups, enterprise app assignments, sign-in logs, and audit logs turned into one review table.

This article shows how an agency or small internal DX team can use Claude Code to prepare a Microsoft Entra ID access review. The goal is not to let AI delete accounts. The goal is to find leavers, shared accounts, stale groups, external guests, and privileged roles so a human can approve the next action.

Key Points

• Review users, groups, apps, shared accounts, guests, and privileged roles separately.
• Microsoft Entra access reviews support recurring checks of group and application access.
• Audit logs show changes to users, groups, applications, and licenses. Sign-in logs show recent usage.
• Lifecycle workflows provide a useful model for offboarding, but account deletion and license removal still need approval.
• Measure remaining enabled leavers, ownerless shared accounts, stale assignments, review time, and consultation inquiries.

Where Internal Access Reviews Break

Agencies add and remove people quickly: employees, contractors, freelancers, client guests, and temporary project owners. Notion, Figma, GitHub, ad platforms, Microsoft 365, billing tools, and file shares often sit behind different assignments. When a client asks who still has access, the operations person opens users, Teams, groups, apps, and logs one by one.

The common failure is checking only leavers. Shared accounts, client groups, stale guests, privileged roles, and app assignments remain. The review should not simply create a deletion list. It should create a table that shows owner, reason, last use, risk, and human approval.

Primary references checked for this article include access reviews overview, create access reviews, audit logs, sign-in logs, Lifecycle workflows offboarding, sharing accounts and credentials, and security defaults.

Workflow: From User List To Review Table

Start with the actual screens: users, groups, Enterprise apps, sign-in logs, and audit logs. Export or copy the relevant columns into a review table: leave date, accountEnabled, department, groups, app assignments, roles, owner, and last sign-in. Before asking Claude Code to help, replace names, email addresses, and client names with sample IDs.

Source	Review field	Claude Code review	Human review
Users	leave date, accountEnabled	enabled leavers	real HR status
Groups	owner, guests, client access	ownerless or stale groups	project status
Enterprise apps	assignments, shared accounts	risky shared access	license and business need
Sign-in logs	last use, failures	stale accounts	leave, break-glass, exceptions
Audit logs	who changed what	evidence trail	approval route

What Claude Code Does And What Humans Decide

Claude Code can clean CSV columns, flag suspicious rows, draft a group-owner email, create a monthly checklist, and separate review categories. Humans decide disablement, deletion, license removal, role removal, guest removal, shared-account replacement, and break-glass policy.

Access reviews are a good formal home for recurring group and application checks. A small team should not start with every resource. Start with client-share groups, social-media shared accounts, and privileged roles.

3 Use Cases

Use case 1: Find enabled leaver accounts

• Input: user list, leave date, accountEnabled, last sign-in, groups, licenses.
• Output: enabled leavers, remaining groups, app assignments, review owner.
• Human review: HR status, contractor continuation, mailbox retention, legal hold, approval.

Claude Code should produce review candidates, not delete commands. The operations lead checks exceptions before disabling anything.

Use case 2: Assign owners to shared accounts

• Input: shared account list, app name, owner, MFA, last sign-in, department.
• Output: ownerless shared accounts, weak authentication, high permission, long-lived access.
• Human review: whether to replace shared passwords with app assignment or managed access.

Microsoft documents password-based SSO and shared account patterns. The practical first step is to stop password handoff and make owner, app, and review date visible.

Use case 3: Run monthly group and app cleanup

• Input: group list, app assignments, owners, guests, last sign-in, project end date.
• Output: access review target, owner message, keep reason, remove candidate, next review date.
• Human review: client contract, project continuation, privileged roles, audit requirements.

Review only a few painful places at first. Client-share groups, external guests, and admin roles give a clear monthly rhythm.

Copy-Paste Prompt

Act as a Microsoft Entra ID access review assistant for a small agency.
Goal: prepare a human-review table for leavers, shared accounts, stale groups, external guests, and privileged roles.

Inputs:
- anonymized users CSV
- groups CSV
- enterprise app assignments CSV
- sign-in log last activity
- audit log change history
- leave dates and project end dates

Return:
1. enabled leavers
2. ownerless shared accounts
3. shared accounts without strong authentication
4. assignments unused for more than 30 days
5. stale privileged accounts
6. client groups with remaining guests
7. actions that require human approval

Constraints:
- replace names, emails, and client names with sample IDs
- never issue deletion or disable commands
- do not mark break-glass accounts as automatic removal candidates
- end with the five rows to inspect today

Working Check Code

// verify-entra-access-review.mjs
// No dependencies. Run with: node verify-entra-access-review.mjs
const accounts = [
  {
    userPrincipalName: "[email protected]",
    department: "design",
    employeeLeaveDate: "2026-06-30",
    accountEnabled: true,
    lastSignInDaysAgo: 2,
    groups: ["client-a-share", "figma-admin"],
    roles: [],
    mfa: true,
    owner: "manager-01"
  },
  {
    userPrincipalName: "[email protected]",
    department: "marketing",
    employeeLeaveDate: null,
    accountEnabled: true,
    lastSignInDaysAgo: 1,
    groups: ["social-media-tools"],
    roles: [],
    mfa: false,
    owner: ""
  },
  {
    userPrincipalName: "[email protected]",
    department: "it",
    employeeLeaveDate: null,
    accountEnabled: true,
    lastSignInDaysAgo: 120,
    groups: [],
    roles: ["Global Administrator"],
    mfa: false,
    owner: "it-lead"
  }
];

const problems = [];
const today = new Date("2026-07-19T00:00:00Z");

for (const account of accounts) {
  if (account.employeeLeaveDate && new Date(account.employeeLeaveDate + "T00:00:00Z") < today && account.accountEnabled) {
    problems.push({ account: account.userPrincipalName, item: "leaver still enabled", fix: "disable account or run the approved offboarding workflow" });
  }
  if (account.userPrincipalName.includes("shared") && !account.owner) {
    problems.push({ account: account.userPrincipalName, item: "shared account owner", fix: "assign an accountable owner and review app assignment" });
  }
  if (account.userPrincipalName.includes("shared") && !account.mfa) {
    problems.push({ account: account.userPrincipalName, item: "shared account MFA", fix: "replace direct password sharing with controlled app access or strong authentication" });
  }
  if (account.roles.length > 0 && account.lastSignInDaysAgo > 90) {
    problems.push({ account: account.userPrincipalName, item: "stale privileged account", fix: "review role need, sign-in logs, and break-glass policy" });
  }
  if (account.groups.length > 0 && account.lastSignInDaysAgo > 30) {
    problems.push({ account: account.userPrincipalName, item: "group access review", fix: "ask the group owner to approve, deny, or remove access" });
  }
}

if (problems.length > 0) {
  console.table(problems);
  process.exitCode = 1;
} else {
  console.log("Entra ID access review checklist passed.");
}

The script checks leave date, enabled status, shared-account owner, MFA, privileged roles, and last sign-in. In real work, combine Entra admin center, audit logs, sign-in logs, access reviews, Lifecycle workflows, and internal approvals.

Pitfall: Common Failure Cases

The first failure is deleting based only on last sign-in. The fix is to review leave date, owner, role, exception reason, and approval together.

The second failure is leaving shared accounts ownerless. Add an accountable owner, app purpose, authentication method, and review date.

The third failure is reviewing users but not groups. Client groups and guests often carry the real access.

The fourth failure is letting AI decide deletion. Claude Code lists candidates and drafts owner messages. Humans approve disablement, deletion, license removal, and role removal.

FAQ

Q. What should a small team review first?

A. Enabled leavers, ownerless shared accounts, and stale privileged accounts. Those three produce a practical first table.

Q. Are access reviews only for large companies?

A. No. Start small with client-share groups, external guests, and privileged roles.

Q. Should all shared accounts be banned immediately?

A. Not always. First make owner, app, authentication method, and expiry visible. Then replace direct password sharing where possible.

Q. Can Claude Code read the real CSV?

A. Use anonymized data. Replace real names, emails, client names, phone numbers, and contract details.

Training And Consultation Signal

Measure enabled leavers, ownerless shared accounts, stale groups, remaining guests, review time, and inquiry rate. If those numbers hurt, Entra ID review operations are a fit for ClaudeCodeLab training.

What I Verified

I checked Microsoft Learn pages for access reviews, creating reviews, audit logs, sign-in logs, Lifecycle workflows, shared accounts, and security defaults. I also checked the CTA, executable JavaScript, internal link, external links, locale coverage, and queue removal.