What you can do
- View MFA coverage — Percentage of users with MFA enabled and a list of users without it
- Monitor conditional access — Track enabled, report-only, and disabled Entra ID policies
- Check device compliance — Percentage of enrolled devices that meet your compliance requirements
- Review sign-in risks — High, medium, and low-risk sign-in events detected by Entra
- Run periodic reviews — Launch attestation campaigns asking employees to confirm access is still needed
- Track completion — Monitor who has completed their review and who needs a reminder
Prerequisite: connect Entra ID
The live signals require a Microsoft Entra ID connection. Configure it via Microsoft Entra ID. Once connected, data syncs automatically every 6 hours.If you don’t use Microsoft Entra ID, skip the live signals and focus on periodic reviews. The attestation evidence still counts as access-review evidence.
How to run a periodic access review
Periodic reviews ask your admins to attest, line by line, that each active user’s access is still necessary — a key control test for SOC 2 Type 2. A quarterly review is created for you automatically (Jan 1 / Apr 1 / Jul 1 / Oct 1), covering every active user in the org, with a 30-day window to complete it. You can also start one on demand:1
Open Access Reviews
Navigate to Compliance → Access Reviews.
2
Click Start ad-hoc review
This snapshots every currently-active user (and, if connected, every enabled Entra ID account) into a new review with a 30-day due date — there’s no scope picker; it always covers everyone.
3
Work through the line items
An admin marks each user’s access as confirmed or flags it for a change.
4
Track completion
Monitor progress; the page flags any review that goes overdue.
5
Review flagged items
Anyone flagged for an access change is followed up on outside the review itself, then the review is closed.
A reviewer may attest their own access line — self-attestation is allowed, not blocked, which matters for solo-admin organizations where the only reviewer is also on the access list. The attestation is recorded with a self-attested flag on the audit log, so the signal is preserved for auditors even though the action itself isn’t stopped.
Live Entra signals
MFA Coverage
Percentage of users with MFA enabled, plus a list of users without MFA. Color-coded green / yellow / red. Users without MFA are a critical access risk — enforce via Entra Conditional Access before audit.Conditional Access
Count of policies by state: Enabled, Report-Only, Disabled. Report-only policies are useful for testing but don’t enforce; transition critical policies to Enabled before audit.Device Compliance
Percentage of enrolled devices meeting your compliance baseline (encryption, antivirus, OS version), plus a list of non-compliant devices and their users.Sign-in Risks
Risky sign-ins detected by Entra, by severity. Helps spot brute-force attacks, impossible travel, anomalous logins. High-risk events should trigger immediate investigation.Last collected timestamp
At the bottom of the page, “Last collected: [date/time]” shows when Regentra last synced from Entra. If you need fresher data than the default 6-hour cadence, click Sync Settings to trigger an immediate refresh.Using access reviews for audit evidence
Periodic review campaigns and completion percentages are direct evidence for auditors that you actively manage access rights. When auditors sample access reviews, they see who was reviewed, when, by whom, who confirmed vs. flagged changes, and timestamps of sign-offs. If you want a standalone artifact for your audit package, screenshot or otherwise document the completed review and attach it to the relevant control in Evidence Collection.Frequently asked questions
How often should I run periodic reviews?
How often should I run periodic reviews?
Quarterly is best practice; semi-annually is the common minimum. Most auditors require evidence of reviews at least annually.
What if someone doesn't complete their review by the due date?
What if someone doesn't complete their review by the due date?
The system tracks non-completion; send reminders. For audit readiness aim for 95%+ completion. Unresponsive users may need escalation to their manager.
Can I use periodic reviews without Entra ID?
Can I use periodic reviews without Entra ID?
Yes. The attestation evidence still counts even without the live signals.
What MFA methods count for MFA coverage?
What MFA methods count for MFA coverage?
Entra recognizes authenticator apps, Windows Hello, FIDO2 keys, and SMS. Conditional Access policies can require specific methods for sensitive roles.
How do I use access review results for audit?
How do I use access review results for audit?
There’s no dedicated export button for a review yet — point the auditor at the review directly in the app, or reference it (with its dates and completion state) in your written evidence.