Revue des accès Entra ID pour une petite agence

Dans une petite agence, les accès Microsoft 365 survivent souvent au projet. Un designer est parti, un compte partagé de réseaux sociaux fonctionne encore, un invité client reste dans Teams et un ancien rôle administrateur n’a jamais été revu. Le premier écran utile est la liste des utilisateurs Entra ID avec groupes, applications, sign-in logs et audit logs.

Key Points

• Sépare utilisateurs, groupes, applications, comptes partagés, invités et rôles.
• Les access reviews aident à revoir régulièrement groupes et applications.
• Les audit logs et sign-in logs donnent les changements et l’usage récent.
• Claude Code prépare la table; l’humain approuve les actions.
• Mesure comptes de sortants, comptes sans propriétaire, groupes inactifs et temps de revue.

Workflow: Build The Review Table First

On commence par une table: date de départ, compte actif, groupes, applications, rôles, propriétaire et dernier sign-in. Avant Claude Code, anonymise noms, emails et clients.

Source	Review field	Human decision
Users	leave date, accountEnabled, department	HR status and exceptions
Groups	owner, guests, project end	client access and contract
Enterprise apps	assignment, shared account, role	business need and license
Sign-in logs	last activity, failures	leave, exception, or cleanup
Audit logs	who changed what	approval trail

Primary sources checked: access reviews, create access reviews, audit logs, sign-in logs, Lifecycle workflows, sharing accounts, and security defaults.

What Claude Code Does And What Humans Decide

Claude Code can clean an anonymized CSV, find enabled leavers, ownerless shared accounts, stale assignments, old privileged roles, and missing owners. Humans decide disablement, deletion, license removal, role removal, guest removal, shared-account replacement, and emergency-account policy.

3 Use Cases

Use case 1: Find enabled leavers

• Input: user list, leave date, accountEnabled, groups, app assignments, last sign-in.
• Output: enabled leavers, remaining groups, app assignments, review owner.
• Human review: HR status, contractor continuation, mailbox retention, legal hold, approval.

Use Claude Code to prepare a candidate list. Do not let it delete accounts.

Use case 2: Review shared accounts

• Input: shared account list, app name, owner, MFA, last sign-in, department.
• Output: ownerless shared accounts, weak authentication, high permission, long-lived access.
• Human review: whether to move to app assignment, SSO, or another managed pattern.

The first win is visibility: owner, app, authentication method, and review date.

Use case 3: Run monthly group cleanup

• Input: groups, app assignments, owners, guests, last use, project end date.
• Output: review target, owner message, keep reason, removal candidate, next review date.
• Human review: client contract, project continuation, privileged role, audit needs.

Start with client-share groups, external guests, and admin roles.

Copy-Paste Prompt

Act as a Microsoft Entra ID access review assistant for a small agency.
Prepare a human-review table for leavers, shared accounts, stale groups, guests, and privileged roles.

Check enabled leavers, ownerless shared accounts, weak shared-account authentication, unused assignments, stale privileged accounts, and groups with guests.
Never issue deletion or disable commands.
Use anonymized IDs only.
Return the five rows to inspect today.

Working Check Code

// verify-entra-access-review.mjs
// No dependencies. Run with: node verify-entra-access-review.mjs
const accounts = [
  {
    userPrincipalName: "[email protected]",
    department: "design",
    employeeLeaveDate: "2026-06-30",
    accountEnabled: true,
    lastSignInDaysAgo: 2,
    groups: ["client-a-share", "figma-admin"],
    roles: [],
    mfa: true,
    owner: "manager-01"
  },
  {
    userPrincipalName: "[email protected]",
    department: "marketing",
    employeeLeaveDate: null,
    accountEnabled: true,
    lastSignInDaysAgo: 1,
    groups: ["social-media-tools"],
    roles: [],
    mfa: false,
    owner: ""
  },
  {
    userPrincipalName: "[email protected]",
    department: "it",
    employeeLeaveDate: null,
    accountEnabled: true,
    lastSignInDaysAgo: 120,
    groups: [],
    roles: ["Global Administrator"],
    mfa: false,
    owner: "it-lead"
  }
];

const problems = [];
const today = new Date("2026-07-19T00:00:00Z");

for (const account of accounts) {
  if (account.employeeLeaveDate && new Date(account.employeeLeaveDate + "T00:00:00Z") < today && account.accountEnabled) {
    problems.push({ account: account.userPrincipalName, item: "leaver still enabled", fix: "disable account or run the approved offboarding workflow" });
  }
  if (account.userPrincipalName.includes("shared") && !account.owner) {
    problems.push({ account: account.userPrincipalName, item: "shared account owner", fix: "assign an accountable owner and review app assignment" });
  }
  if (account.userPrincipalName.includes("shared") && !account.mfa) {
    problems.push({ account: account.userPrincipalName, item: "shared account MFA", fix: "replace direct password sharing with controlled app access or strong authentication" });
  }
  if (account.roles.length > 0 && account.lastSignInDaysAgo > 90) {
    problems.push({ account: account.userPrincipalName, item: "stale privileged account", fix: "review role need, sign-in logs, and break-glass policy" });
  }
  if (account.groups.length > 0 && account.lastSignInDaysAgo > 30) {
    problems.push({ account: account.userPrincipalName, item: "group access review", fix: "ask the group owner to approve, deny, or remove access" });
  }
}

if (problems.length > 0) {
  console.table(problems);
  process.exitCode = 1;
} else {
  console.log("Entra ID access review checklist passed.");
}

Pitfall: Common Failure Cases

The first failure is using last sign-in as the only signal. Add leave date, owner, role, exception, and approval. The second failure is leaving shared accounts ownerless. The third failure is reviewing users but missing groups. The fourth failure is letting AI decide deletion. Claude Code prepares candidates; humans approve changes.

FAQ

Q. What should a small team review first?

A. Enabled leavers, ownerless shared accounts, and stale privileged accounts.

Q. Are access reviews only for large companies?

A. No. Start with client-share groups, guests, and privileged roles.

Q. Can shared accounts remain?

A. Sometimes, but owner, app purpose, authentication method, and review date must be visible.

Q. Can Claude Code read real logs?

A. Use anonymized CSV data. Do not include real names, emails, client names, phone numbers, or contracts.

Training And Consultation Signal

Measure enabled leavers, ownerless shared accounts, stale groups, guests, review time, and inquiry rate. If those numbers hurt, Entra ID review operations are a fit for formation ClaudeCodeLab.

What I Verified

I checked Microsoft Learn references for access reviews, audit logs, sign-in logs, Lifecycle workflows, shared accounts, and security defaults. I also checked the CTA, executable JavaScript, internal link, external links, locale coverage, and queue removal.