Privileged Access Review Report
The prompt
In Microsoft Entra ID, produce a privileged access review report for [QUARTER/YEAR]. Include: 1. All users with permanent Global Administrator, Security Administrator, or Privileged Role Administrator roles 2. For each: display name, UPN, account type (member/guest), MFA status, last sign-in date, and whether the assignment is PIM-eligible or permanent 3. Users with privileged roles who have not signed in within the last 90 days 4. Guest accounts with any privileged role assignment 5. Changes to privileged role assignments in the last 90 days: who was added, who was removed, and by whom Format as a formal access review report. Flag accounts that should be reviewed for removal.
How to use it
- 1Select Copy the prompt above.
- 2Paste it into Microsoft 365 Copilot.
- 3Replace anything in brackets with your own detail, then send it.
Copilot gathers and drafts. You verify and decide. Check every figure, name and date against the system it came from before you act on it.
Written for
Security Manager, Identity Lead, Internal Audit, CISO
More for Microsoft Copilot for Security
- First Look — Incident Summary
- Alert Triage — Is This a True Positive?
- Multi-Alert Correlation — Single Incident Thread
- Device Investigation — Rapid Scope
From the source collection in awesome-microsoft-copilot-prompts, licensed CC BY-SA 4.0.