Access reviews require an Azure AD Premium P2 license.
Access reviews for Group1 and App1 can be configured in Azure AD Access Reviews.
Access reviews for the Contributor role and Role1 would need to be conf igured in Privileged Identity Management (PIM). PIM is included in Azure AD Premium P2.
Reference:
https://docs.microsoft.com/en-us/azure/active-directory/privileged-identity-management/pim-how-to-start- security-review?toc=/azure/active-directory/governan ce/toc.json
https://docs.microsoft.com/en-us/azure/active-directory/governance/access-reviews-overview According to the Microsoft Identity and Access Administrator (SC-300) official study guide and Microsoft Learn training module "Manage Access Reviews" , Azure AD Access Reviews allow administrators to periodically evaluate user access to critical resources across Azure AD and Azure.
The exam objectives explicitly list access review capabilities that apply to the following resource types:
Groups (Microsoft 365 or security groups) - Access reviews can be used to ensure that group memberships are up to date. In this case, Group1 is eligible since it has an Assigned membership type , which means access reviews can target its members.
Enterprise applications (Ap p1) - Access reviews can assess users who have access to enterprise applications registered in Azure AD, ensuring that only the right users retain application access.
Azure AD roles (Role1) - Access reviews can be created for privileged directory roles (li ke Global Administrator or custom roles such as Role1) to validate continued need for elevated permissions.
Azure subscription roles (Contributor) - Access reviews can also be applied to Azure resources and management groups when integrated with Azure AD P rivileged Identity Management (PIM). This ensures least-privilege access by reviewing roles like "Contributor." Therefore, based on Microsoft documentation:
"Access reviews can be configured for Azure AD groups, enterprise applications, Azure AD roles, and Azure resource roles to ensure that access rights remain appropriate." This means all four - Group1, App1, Contributor, and Role1 - are supported targets for access reviews.