Skip to main content
Access reviews are periodic or on-demand campaigns that ask managers or resource owners to confirm whether users should retain their current access. Nexus automates the entire lifecycle — from sending reviewer notifications to enforcing decisions at the close of the review — so your team can run a rigorous certification program without manual coordination overhead. Reviews are a core part of a zero-trust access strategy because they ensure that permissions granted in the past remain appropriate as roles, teams, and responsibilities evolve.

​
Types of access reviews

Nexus supports three categories of access review, each targeting a distinct layer of your Entra estate.

1. Group Membership Reviews

Certify who should remain a member of a security group or Microsoft 365 group. Group membership is a common way to grant access to SharePoint sites, Teams channels, distribution lists, and Conditional Access policies, making it a high-value target for regular certification.

2. Application Access Reviews

Certify who should retain access to an enterprise application in your tenant. This covers any app that users sign into via Entra ID, including SaaS applications, internal tools, and custom line-of-business apps integrated through the app gallery or custom registrations.

3. Privileged Role Reviews

Certify who should retain assignments to Entra ID directory roles such as Global Administrator, User Administrator, or Exchange Administrator. Privileged role reviews are the highest-priority review type and are recommended on at least a quarterly cadence for all privileged roles.

​
Creating an access review

1

Open the New Review dialog

Navigate to Access Reviews in the left navigation sidebar and click New Review in the top-right corner of the page.
2

Select the review scope

Choose the type of review you want to run: Group Membership, Application Access, or Privileged Role. Then select the specific group, application, or role you want to certify. You can select multiple objects if you want to bundle related resources into a single review campaign.
3

Choose reviewers

Assign who will be responsible for making approve/deny decisions. You can designate:
  • Resource owners — the owner of the group or application as recorded in Entra ID
  • Managers — each user’s direct manager as resolved from the Entra directory
  • Specific users — one or more named individuals, useful for centralized review programs run by your security or compliance team
4

Set the schedule

Choose between a one-time review for ad-hoc certification needs or a recurring review on a weekly, monthly, or quarterly cadence. For recurring reviews, Nexus automatically creates the next review instance when the current one closes.
5

Configure auto-apply

Toggle Auto-Apply Decisions to control what happens when the review period ends. When enabled, Nexus automatically removes access for any user whose decision is recorded as Deny at the close of the review. When disabled, an administrator must manually apply the decisions after reviewing them — useful when you want a secondary verification step before access is removed.
6

Create the review

Click Create. Nexus immediately sends email notifications to all assigned reviewers with a direct link to the review portal. Reviewers who have not responded receive automated reminder emails as the deadline approaches.

​
Completing a review as a reviewer

When you are assigned as a reviewer, you receive an email from Nexus with a direct link to your review queue. You do not need to log in to the Nexus platform first — the link takes you directly to the review portal. In the review portal, you see a list of every user in scope for the review. For each user you can:
  • Click Approve to confirm the user should retain their access.
  • Click Deny to flag the user for access removal.
  • Enter a justification note in the text field — this is required for deny decisions and optional for approvals. Justification notes are stored in the audit log and are visible to administrators.
Once you’ve made decisions for all users in your queue, click Submit Decisions. You can return and update decisions at any time before the review deadline. Nexus tracks your completion status in real time so administrators can see who has and hasn’t responded.
You can approve or deny decisions in bulk using the checkboxes on the left side of the user list. Select multiple users and use the Bulk Approve or Bulk Deny buttons that appear in the action bar.

​
Monitoring review progress

The Review Dashboard gives administrators a live view of every active review campaign. For each review you can see:
  • Completion percentage — the proportion of total decisions that have been submitted across all reviewers
  • Pending reviewers — a list of reviewers who have not yet submitted any decisions, with their assigned user count
  • Decisions summary — a breakdown of approve, deny, and not-yet-reviewed counts
  • Deadline countdown — time remaining until the review closes, displayed as a prominent countdown
If a reviewer is unresponsive, you can send a manual reminder directly from the review dashboard or reassign their portion of the review to another user without disrupting the rest of the campaign. When the review closes, the Results tab shows the full decision log — every user, every decision, every justification note, and which reviewer submitted it — formatted for export as a compliance artifact.
You can configure auto-apply to enforce decisions automatically when the review closes, or choose to apply decisions manually for an additional verification step. Manual application is recommended for high-stakes reviews such as privileged role certifications where a second set of eyes on the final results adds meaningful assurance.