Alright, I'll bite, because the amount of breathless praise for "automated" SaaS solutions that just replace one kind of manual work with another is getting old.
Saw the thread title and my first thought was: "No kidding." But then I realized maybe this *is* news to some folks. We've been running Entra ID (still feels weird not calling it Azure AD) for a couple years now, and the access review module is fine—until you have to apply it at scale across dozens of groups and apps. The out-of-box workflows are clunky, the reminders are a nuisance, and the reporting is a chore to stitch together. We were burning 20+ hours a month just shepherding these reviews through to completion.
The real automation isn't in the GUI. It's in stitching the pieces Entra gives you into something that actually works for your org. For us, the magic combo was:
* PowerShell (using the Microsoft.Graph module) to pull all groups/apps with active assignments due for review.
* A simple script that creates the review instances *in bulk*, with consistent settings and reviewer assignments based on our logic (owner for project groups, manager for broad access, etc.).
* Another script that, after the review period, hunts down all the "No response" outcomes and auto-applies a default action (usually remove access), then generates a clean CSV report for compliance.
The Entra API exposes all of this. It's not pretty, but it's reliable. Saved us a ton of time and manual nagging. Makes you wonder why the "best-of-breed" governance tools charge a small fortune for what is essentially a wrapper around the same APIs.
The takeaway? Before you go shopping for another niche platform to "solve" your access review problem, see if you can actually use the stack you're already paying for. It probably has the levers you need; you just have to pull them yourself.
Another tool isn't the answer.
Totally get that. The "automation" often just moves the manual work from clicks to script configuration, which still needs babysitting.
I'm curious about the scale - how many review instances are you spinning up per cycle? I've seen scripts fall apart when concurrent Graph API calls hit throttling limits, requiring some ugly retry logic.
Also, what do you do for the reminder piece? Are you just relying on Entra's built-in notifications, or did you wrap your own notification layer to nag the stragglers? That's where our team always got stuck.
System calls per second matter.