Printable worksheet · landscape

Administrator Access Review Worksheet

For IT teams reviewing who holds administrator roles in Microsoft Entra ID, how those roles are assigned, and whether each one is still needed. Work from the role assignments in the Entra admin centre.

To print, use your browser’s print command (Ctrl+P, or ⌘P on a Mac). Landscape works best.

Organisation
Reviewer
Date

Don’t record secrets. No passwords, recovery codes, tokens or full user principal names. Use roles or initials, and keep the completed sheet somewhere access-controlled.

PART 1Role holders

One row per person per role. Start with the most powerful roles (Global Administrator, Privileged Role Administrator, Security Administrator, Exchange and SharePoint administrators), then work down. The first row is an example.

Account type: D = dedicated admin account · N = normal daily account
Assignment: P = permanent · E = eligible (activated through PIM)

Role	Held by (role or initials)	Account type (D/N)	Assignment (P/E)	Sign-in method	Last used / activated	Still needed? (Y/N)	Action
Example: Global Administrator	IT manager	N	P	Authenticator app	Last week	Y	Move to dedicated account; make eligible

PART 2Emergency-access accounts

One row per emergency account. If you don’t have any, note that as a finding in Part 3.

Account (label only)	Cloud-only? (Y/N)	Excluded only where needed? (Y/N)	Sign-in alert set up? (Y/N)	Credentials stored securely? (Y/N)	Last test date

PART 3Findings and actions

Common findings: admin roles on daily accounts, permanent assignments that could be eligible, roles unused for months, former staff still assigned, no emergency accounts.

Finding	Action	Owner	Due	Done

Administrator Access Review Worksheet · Redgate Protection · redgateprotection.com/admin-access-worksheet.html. An internal review aid, not an audit or certification. Eligible assignments need Privileged Identity Management, which depends on your Entra ID licence. About privileged-role configuration