Skip to content

Manual Test Runbook — H6: Entra Access Reviews (Entitlement Management)

Owner: Sagar  |  Time: ~5 min (Parts A + B, offline) · +30 min Part C (apply catalog + packages) · +20 min Part D (attach resource roles + trigger a review instance)  |  Sandbox: snowops-sandbox-tenant-01

Promotes H6 (modules/azure/access-reviews/) from 🟦 Code Complete → 🟩 Shipped. Part C provisions the catalog + access packages + recurring-review policies (no charge). Part D attaches a resource role and confirms the recurring review instance is scheduled. Requires Microsoft Entra ID P2 (access reviews + Entitlement Management are P2 features).

Scope reminder: H6 is the native-config recurring-review control. E6 (apps/access-review/) is the separate evidence/reporting app — see its own runbook for the CSV/Markdown artifact path. H6 makes Entra recertify; E6 produces the offline evidence.

Prerequisites

  • Sandbox AAD tenant access (Identity Governance Administrator role active)
  • Microsoft Entra ID P2 license active on the sandbox tenant
  • A reviewer/approver group, e.g. snowops-access-reviewers, whose members will recertify the package each cycle
  • A resource group/app/group to bundle into a package for the live test (e.g. the snowops-prod-admins AAD group)
  • Local tooling: terraform >= 1.6, go >= 1.22, az CLI >= 2.50, jq
  • SNOWOPS_SANDBOX_TENANT_ID env var set
  • Working directory: repo root

Steps

Part A — terraform fmt + validate (offline, ~2 min)

  1. Confirm formatting + structural validity of the module:
terraform -chdir=modules/azure/access-reviews fmt -check
terraform -chdir=modules/azure/access-reviews init -backend=false -input=false
terraform -chdir=modules/azure/access-reviews validate

Expected: Success!. (Online init may be needed if the cached provider is absent; the committed .terraform.lock.hcl pins azuread 3.x.)

  1. Run the H6 offline Terratest case:
cd tests/terratest
go test -v -timeout 5m -run 'TestAccessReviewsValidate' ./modules/azure/

Expected: 1 top-level test passes.

Part B — full Terratest suite (offline, ~3 min)

  1. Run the whole offline suite:
cd tests/terratest
go test -v -timeout 10m ./...

Expected: all offline *Validate tests pass (H6 included).

Part C — apply catalog + packages (real AAD apply, ~30 min)

  1. Capture the reviewer group:
export SNOWOPS_SANDBOX_TENANT_ID="<sandbox-tenant-guid>"
export SNOWOPS_REVIEWER_GROUP_ID=$(az ad group show --group snowops-access-reviewers --query id -o tsv)
  1. Apply against the sandbox tenant:
cd tests/terratest/fixtures/access-reviews
terraform init
terraform apply \
  -var "tenant_id=$SNOWOPS_SANDBOX_TENANT_ID" \
  -var "reviewer_group_object_id=$SNOWOPS_REVIEWER_GROUP_ID"

  1. Spot-check the portal (Microsoft Entra ID → Identity governance → Entitlement management → Catalogs): the SnowOps Access Reviews (validate) catalog exists with two access packages (Production Admins, Billing Readers).

  2. For each package, open its assignment policy → Lifecycle / Access reviews tab and confirm:

  3. Production Admins: recurring review enabled, frequency quarterly, reviewers = snowops-access-reviewers, "if reviewers don't respond" = Remove access (removeAccess default), justification required.

  4. Billing Readers: recurring review enabled, frequency annual, reviewer type Group owners, timeout = Take recommendations (acceptAccessRecommendation).

  5. Confirm terraform output returns:

  6. package_count = 2
  7. Non-empty access_package_ids + assignment_policy_ids maps
  8. review_frequency = { "prod-admins" = "quarterly", "billing-readers" = "annual" }

Part D — attach a resource role + verify the recurring review (~20 min)

H6 provisions the package + the recurring-review cadence. The resource roles bundled into a package (group membership / app role / SharePoint site) are attached out-of-band — this step wires one in and confirms a review instance schedules.

  1. Add the snowops-prod-admins group as a resource role on the Production Admins package (portal: Entitlement management → Access packages → Production Admins → Resource roles → Add resource roles → Groups and Teams), or via az rest against https://graph.microsoft.com/v1.0/identityGovernance/entitlementManagement/accessPackages/<id>/resourceRoleScopes.

  2. Assign at least one test user to the package (Access packages → Production Admins → Assignments → New assignment) so the next review cycle has a subject to recertify.

  3. Confirm a review instance is scheduled: Identity governance → Access reviews → look for the entitlement-management-backed review for the Production Admins package; its first instance start date should be within the configured quarterly window. (You can also start an instance manually from the review's overview to drill the reviewer flow immediately.)

  4. As a member of snowops-access-reviewers, open https://myaccess.microsoft.com → Access reviews → recertify the test user (Approve / Deny + justification). Expected:

    • Justification field is required (approver_justification_required).
    • On Deny (or on a left-un-actioned instance close), access is removed (removeAccess timeout default).

Pass criteria

  • Part A — terraform validate passes for the module
  • Part B — full offline Terratest suite passes (H6 included)
  • Part C Step 6 — catalog + 2 packages visible in the portal
  • Part C Step 7 — both review policies match the configured cadence / reviewer type / timeout behavior
  • Part C Step 8 — outputs correct (package_count = 2, frequency map)
  • Part D Step 11 — a recurring review instance is scheduled for the package
  • Part D Step 12 — reviewer flow requires justification; timeout = remove

Teardown

cd tests/terratest/fixtures/access-reviews
terraform destroy \
  -var "tenant_id=$SNOWOPS_SANDBOX_TENANT_ID" \
  -var "reviewer_group_object_id=$SNOWOPS_REVIEWER_GROUP_ID"

Removes the assignment policies (stopping the recurring reviews), then the access packages, then the catalog. Any in-flight review instance is cancelled. Existing assignments created through a package are not retroactively revoked by destroy — they simply stop being recertified. Detach resource roles / clean up the test user assignment from Step 9–10 manually if needed.

Sign-off

  • Tester: _  |  Date: _  |  Result: PASS / FAIL / N/A
  • Notes: