The problem
People who hold PIM roles are usually also the ones asked to attest to them in Entra access reviews. Today those decisions live in email reminders and the My Access portal, so they are easy to miss until the review closes and access is removed. Elevate already shows the other "decide something" queue, PIM activation approvals, in the panel; access reviews are the same shape but need a portal visit.
What you would like Elevate to do
- Show the signed-in user's pending access review instances next to the Approvals section, per tenant: review name, the resource under review (group, role, access package), the number of decisions waiting, and the due date.
- Expand a review into its decision items (each principal or one's own self-review) and approve or deny per item with a justification, or "accept recommendations" where Entra supplies them.
- Notify once when a new review is assigned and again shortly before its due date; show a badge on the menu bar / tray icon while decisions are outstanding, like pending approvals do today.
- CLI:
elevate reviews list|decide with --json, so the same decisions can be scripted.
Area
Approvals
Alternatives you considered
- Keep using the portal and email reminders (status quo).
- A "reviews waiting" link that opens My Access at the right place, without deciding in Elevate. Cheaper, but leaves the portal visit in place.
Anything else
- Graph exposes the signed-in user's pending instances at
GET /identityGovernance/accessReviews/definitions/{id}/instances/filterByCurrentUser(on='reviewer') and the decisions at .../instances/{id}/decisions/filterByCurrentUser(on='reviewer'); deciding is a PATCH on the decision. The delegated permission is AccessReview.ReadWrite.All, which a user can consent to for their own reviewer scope, so no admin consent step beyond the existing one.
- Accounts added with the Azure CLI / Azure PowerShell app cannot use this, for the same reason they cannot see Entra approvals.
- Related: the existing approvals feature (docs/approvals.md) and its spec docs/superpowers/specs/2026-09-05-elevate-approvals-design.md.
The problem
People who hold PIM roles are usually also the ones asked to attest to them in Entra access reviews. Today those decisions live in email reminders and the My Access portal, so they are easy to miss until the review closes and access is removed. Elevate already shows the other "decide something" queue, PIM activation approvals, in the panel; access reviews are the same shape but need a portal visit.
What you would like Elevate to do
elevate reviews list|decidewith--json, so the same decisions can be scripted.Area
Approvals
Alternatives you considered
Anything else
GET /identityGovernance/accessReviews/definitions/{id}/instances/filterByCurrentUser(on='reviewer')and the decisions at.../instances/{id}/decisions/filterByCurrentUser(on='reviewer'); deciding is a PATCH on the decision. The delegated permission isAccessReview.ReadWrite.All, which a user can consent to for their own reviewer scope, so no admin consent step beyond the existing one.