Protect · Established tier · Identity and Access

PR-04Access is recertified to least privilege

User entitlements are reviewed on a cycle, and access no longer needed is removed.

Status

Partial evidence

1 item only partly supports it.

Exposure

High

1 evidence items from 1 sources

CCSA · Protect

Below Foundational

Not blocking this domain's next tier.

What the evidence shows

The last recertification closed with 11% of entitlements unreviewed, and unreviewed access was kept by default.

Remediation · Identity and Access

Reopen the review for the unreviewed 11% and switch the default to revoke at close.

Every item is read-only, dated, hashed and re-runnable. This is what an examiner can test.

ev-pr04-1

Recertification closed with 89% of entitlements reviewed

Microsoft Entra ID · export · collected 30 h ago (Oct 14, 2026 · 09:01 UTC) · limit 90 days

Partial

Query: GET /identityGovernance/accessReviews/definitions/q3-entitlements/instances
Identity: app assurance-ro (AccessReview.Read.All)
Collector: entra-collector 2.7.0
Window: 2160 h
Records: 18,904
SHA-256: 45ab5a51ec394458dec5e5496e5e6b39c1652a6488316057f51215266eb1b5e6