Review Akses Entra ID untuk Agensi Kecil

Di agensi kecil, akses Microsoft 365 sering tetap hidup setelah proyek selesai. Desainer sudah keluar, akun bersama media sosial masih aktif, tamu klien tetap ada di Teams, dan role admin lama belum pernah ditinjau. Layar pertama yang perlu dilihat adalah daftar user Entra ID bersama grup, apps, sign-in logs, dan audit logs.

Key Points

• Pisahkan user, grup, apps, akun bersama, guest, dan role.
• Access reviews membantu pengecekan grup dan aplikasi secara berkala.
• Audit logs dan sign-in logs menunjukkan perubahan dan penggunaan terbaru.
• Claude Code menyiapkan tabel; manusia menyetujui tindakan.
• Ukur akun mantan staf, akun tanpa owner, grup lama, dan waktu review.

Workflow: Build The Review Table First

Mulai dari tabel: tanggal keluar, accountEnabled, grup, apps, role, owner, dan last sign-in. Sebelum Claude Code, ubah nama asli, email, dan nama klien menjadi ID contoh.

Source	Review field	Human decision
Users	leave date, accountEnabled, department	HR status and exceptions
Groups	owner, guests, project end	client access and contract
Enterprise apps	assignment, shared account, role	business need and license
Sign-in logs	last activity, failures	leave, exception, or cleanup
Audit logs	who changed what	approval trail

Primary sources checked: access reviews, create access reviews, audit logs, sign-in logs, Lifecycle workflows, sharing accounts, and security defaults.

What Claude Code Does And What Humans Decide

Claude Code can clean an anonymized CSV, find enabled leavers, ownerless shared accounts, stale assignments, old privileged roles, and missing owners. Humans decide disablement, deletion, license removal, role removal, guest removal, shared-account replacement, and emergency-account policy.

3 Use Cases

Use case 1: Find enabled leavers

• Input: user list, leave date, accountEnabled, groups, app assignments, last sign-in.
• Output: enabled leavers, remaining groups, app assignments, review owner.
• Human review: HR status, contractor continuation, mailbox retention, legal hold, approval.

Use Claude Code to prepare a candidate list. Do not let it delete accounts.

Use case 2: Review shared accounts

• Input: shared account list, app name, owner, MFA, last sign-in, department.
• Output: ownerless shared accounts, weak authentication, high permission, long-lived access.
• Human review: whether to move to app assignment, SSO, or another managed pattern.

The first win is visibility: owner, app, authentication method, and review date.

Use case 3: Run monthly group cleanup

• Input: groups, app assignments, owners, guests, last use, project end date.
• Output: review target, owner message, keep reason, removal candidate, next review date.
• Human review: client contract, project continuation, privileged role, audit needs.

Start with client-share groups, external guests, and admin roles.

Copy-Paste Prompt

Act as a Microsoft Entra ID access review assistant for a small agency.
Prepare a human-review table for leavers, shared accounts, stale groups, guests, and privileged roles.

Check enabled leavers, ownerless shared accounts, weak shared-account authentication, unused assignments, stale privileged accounts, and groups with guests.
Never issue deletion or disable commands.
Use anonymized IDs only.
Return the five rows to inspect today.

Working Check Code

// verify-entra-access-review.mjs
// No dependencies. Run with: node verify-entra-access-review.mjs
const accounts = [
  {
    userPrincipalName: "[email protected]",
    department: "design",
    employeeLeaveDate: "2026-06-30",
    accountEnabled: true,
    lastSignInDaysAgo: 2,
    groups: ["client-a-share", "figma-admin"],
    roles: [],
    mfa: true,
    owner: "manager-01"
  },
  {
    userPrincipalName: "[email protected]",
    department: "marketing",
    employeeLeaveDate: null,
    accountEnabled: true,
    lastSignInDaysAgo: 1,
    groups: ["social-media-tools"],
    roles: [],
    mfa: false,
    owner: ""
  },
  {
    userPrincipalName: "[email protected]",
    department: "it",
    employeeLeaveDate: null,
    accountEnabled: true,
    lastSignInDaysAgo: 120,
    groups: [],
    roles: ["Global Administrator"],
    mfa: false,
    owner: "it-lead"
  }
];

const problems = [];
const today = new Date("2026-07-19T00:00:00Z");

for (const account of accounts) {
  if (account.employeeLeaveDate && new Date(account.employeeLeaveDate + "T00:00:00Z") < today && account.accountEnabled) {
    problems.push({ account: account.userPrincipalName, item: "leaver still enabled", fix: "disable account or run the approved offboarding workflow" });
  }
  if (account.userPrincipalName.includes("shared") && !account.owner) {
    problems.push({ account: account.userPrincipalName, item: "shared account owner", fix: "assign an accountable owner and review app assignment" });
  }
  if (account.userPrincipalName.includes("shared") && !account.mfa) {
    problems.push({ account: account.userPrincipalName, item: "shared account MFA", fix: "replace direct password sharing with controlled app access or strong authentication" });
  }
  if (account.roles.length > 0 && account.lastSignInDaysAgo > 90) {
    problems.push({ account: account.userPrincipalName, item: "stale privileged account", fix: "review role need, sign-in logs, and break-glass policy" });
  }
  if (account.groups.length > 0 && account.lastSignInDaysAgo > 30) {
    problems.push({ account: account.userPrincipalName, item: "group access review", fix: "ask the group owner to approve, deny, or remove access" });
  }
}

if (problems.length > 0) {
  console.table(problems);
  process.exitCode = 1;
} else {
  console.log("Entra ID access review checklist passed.");
}

Pitfall: Common Failure Cases

The first failure is using last sign-in as the only signal. Add leave date, owner, role, exception, and approval. The second failure is leaving shared accounts ownerless. The third failure is reviewing users but missing groups. The fourth failure is letting AI decide deletion. Claude Code prepares candidates; humans approve changes.

FAQ

Q. What should a small team review first?

A. Enabled leavers, ownerless shared accounts, and stale privileged accounts.

Q. Are access reviews only for large companies?

A. No. Start with client-share groups, guests, and privileged roles.

Q. Can shared accounts remain?

A. Sometimes, but owner, app purpose, authentication method, and review date must be visible.

Q. Can Claude Code read real logs?

A. Use anonymized CSV data. Do not include real names, emails, client names, phone numbers, or contracts.

Training And Consultation Signal

Measure enabled leavers, ownerless shared accounts, stale groups, guests, review time, and inquiry rate. If those numbers hurt, Entra ID review operations are a fit for pelatihan ClaudeCodeLab.

What I Verified

I checked Microsoft Learn references for access reviews, audit logs, sign-in logs, Lifecycle workflows, shared accounts, and security defaults. I also checked the CTA, executable JavaScript, internal link, external links, locale coverage, and queue removal.