Use catalog access reviews in Microsoft Entra ID to review a user’s access across multiple supported resource types in one review experience. First add the resources to an entitlement management catalog, then create a review from the catalog access review template. The supported resource types are groups, applications, and custom data provided resources.
What a catalog access review covers
A catalog review aggregates access to eligible resources in an entitlement management catalog so reviewers can assess a user’s access across those resource types together. Microsoft documents support for:
As an Amazon Associate I earn from qualifying purchases.
- Groups and Teams: review group membership.
- Applications: review app role assignments.
- Custom data provided resources: review resource data supplied by an organization’s custom data provider.
Resources must be added to the catalog before they can be included. See Microsoft’s Catalog Access Reviews documentation for the supported resource details.
How this differs from a standard group or application review
Selecting multiple groups or applications in the ordinary group-and-application review workflow does not combine them into one review. Microsoft creates a separate review for each selected resource. For example, selecting five groups creates five reviews. To review supported resources together through one catalog review experience, use catalog access reviews.
#1 Best Overall
- Supports FIDO2 biometric authentication services and FIDO U2F services requiring security key functionality. Secure and flexible authentication across multiple platforms.
- Exceptional biometric performance, 360° readability, and advanced anti-spoofing technology.
- Designed for portability, it comes with a cover to protect the security key when not in use.
- Aligns with cybersecurity measures that comply with key privacy laws and regulations, including GDPR, BIPA, and CCPA. Approved for use in U.S. federal government institutions.
- Passkey compatibility with Microsoft, Google, and Apple for a convenient and secure sign-in experience. Certified for Microsoft Entra ID for secure multifactor integration with Microsoft services.
Microsoft’s standard review creation guidance describes that separate-review behavior. Access reviews also have distinct boundaries: group memberships and connected application assignments use access reviews; Entra and Azure resource roles are handled through Privileged Identity Management; and access package assignments are managed through entitlement management. See What are access reviews?.
Prepare the catalog and review scope
Before creating the review, decide which resources belong in the catalog and whose access should be assessed. A catalog creator or administrator must add the resources first. Custom data provided resources also depend on the organization having a custom data provider and supplying its resource data.
Rank #2
- POWERFUL SECURITY KEY: The Security Key C NFC is the essential physical passkey for protecting your digital life from phishing attacks. It ensures only you can access your accounts.
- WORKS WITH 1000+ ACCOUNTS: Compatible with Google, Microsoft, and Apple. A single Security Key C NFC secures 100 of your favorite accounts, including email, password managers, and more.
- FAST & CONVENIENT LOGIN: Plug in your Security Key C NFC via USB-C and tap it, or tap it against your phone (NFC) to authenticate. No batteries, no internet connection, and no extra fees required.
- TRUSTED PASSKEY TECHNOLOGY: Uses the latest passkey standards (FIDO2/WebAuthn & FIDO U2F) but does not support One-Time Passwords. For complex needs, check out the YubiKey 5 Series.
- BUILT TO LAST: Made from tough, waterproof, and crush-resistant materials. Manufactured in Sweden and programmed in the USA with the highest security standards.
Microsoft states that catalog access reviews require a Microsoft Entra ID Governance or Microsoft Entra Suite subscription. Licensing can vary by capability, so verify the tenant’s eligibility and the exact feature requirement before deployment. The broader access reviews overview identifies Governance as required for reviewing multiple resources together.
Do these 3 things before closing this tab:
1Clear out junk files and repair common Windows errors2Scan for outdated or missing drivers - takes under a minute3Repair Windows errors before they cause bigger problemsCreate a catalog access review
- In the Microsoft Entra admin center, go to ID Governance > Access Reviews.
- Select New access review.
- Choose the template for reviewing users’ access across multiple resource types within a catalog.
- Select the catalog containing the resources to review.
- Choose the reviewers and configure the review schedule.
- Configure optional reviewer experience and completion settings. If needed, set up a multi-stage review; resource owners can be secondary reviewers.
- Create the review.
Microsoft documents that catalog reviews can also be created programmatically with Microsoft Graph. The specific API permissions and parameters are not covered here; consult the current API documentation before automating the workflow. For the portal workflow and feature details, see Microsoft’s catalog review guide.
Rank #3
- Supports FIDO2 biometric authentication services and FIDO U2F services requiring security key functionality. Secure and flexible authentication across multiple platforms.
- Exceptional biometric performance, 360° readability, and advanced anti-spoofing technology.
- Designed for portability, it comes with a cover to protect the security key when not in use.
- Aligns with cybersecurity measures that comply with key privacy laws and regulations, including GDPR, BIPA, and CCPA. Approved for use in U.S. federal government institutions.
- Passkey compatibility with Microsoft, Google, and Apple for a convenient and secure sign-in experience. Certified for Microsoft Entra ID for secure multifactor integration with Microsoft services.
Set the review policy before launch
There is no single review schedule or decision policy that suits every organization. Microsoft’s deployment planning guidance recommends making governance choices up front, including:
- Which resources and whose access will be reviewed.
- How often reviews will run and who will review access.
- Reviewer communications, deadlines, and timelines.
- Whether decisions or reviewer nonresponse trigger automatic actions.
- How administrators will follow up manually and communicate the actions taken.
These choices determine how a review operates; do not assume a universal default for frequency, reviewer assignments, or automatic remediation.
Rank #4
- FIDO2 + FIDO U2F certified security key, supports PIV credential authentication
- Sits with a low-profile when plugged-in
- Works in every browser without installing any drivers
- Supports desktops, laptops, tablets, and Android mobile devices via USB-C
- Helps protect your accounts from phishing and other cyber-attacks. Prevents your devices from unauthorized use.
Account for changes close to the start time
Microsoft warns that changes made within 12 hours before a catalog review starts—such as adding users or resources—may not be reflected in that review. If the review needs a complete starting snapshot, make catalog and membership changes sufficiently ahead of the scheduled start, then check the review scope once it begins.
Recommended Free Tools
Choose the right Entra workflow
Use a catalog access review when the goal is one review experience covering users’ access across supported resource types in a catalog. Use the standard group or application review workflow when the review is for those resources individually; selecting several there still creates separate reviews. For resource roles or access package assignments, follow the separate workflows Microsoft identifies in its access reviews overview.
Best Value
- FIDO2 + FIDO U2F certified and supported USB security key
- Supports Computers, Laptops, Tablets, and Mobile Devices with a USB-C port and/or NFC
- Works without downloading any drivers. Supported OS: Android, Chrome OS, Windows, MacOS, Linux
- Durable design made to last for a long time with everyday use. Water-resistant (IP67)
- Helps protect your accounts from phishing and other cyber-attacks. Prevents your devices from unauthorized use.
For general prerequisites and the standard review lifecycle, see Microsoft’s Manage user access with Microsoft Entra access reviews.
Quick Recap
Product prices and availability are accurate as of the date/time indicated and are subject to change. Any price and availability information displayed on Amazon at the time of purchase will apply.
