Entra ID access review stuck in initializing state: timeout troubleshooting

Not specified by the original author.

TL;DR

Wait a measured interval and check the instance status through Graph before you delete anything, because large scopes legitimately take time to build. Note the scope, the number of principals and whether reviewers are users, managers or group owners, since reviewer resolution is the step that most often stalls. If the status never moves, delete the stuck instance, fix the scope or reviewer source that stalled it, and let the schedule create a fresh instance rather than forcing the broken one.

Entra ID access review stuck in initializing state: timeout troubleshooting

Use this when

• A new access review instance stays at initializing long past the usual start window.
• Reviewers never receive tasks although the schedule fired on time.
• Only reviews with very large groups or manager reviewers stall.

Not for this skill when

• The review is in progress and reviewers are deciding. That is normal operation, not a stall.
• The definition itself is missing. Work the definition lookup problem instead.

Steps

1. Record when the instance was created, its scope and its reviewer type, and check the Microsoft service health view for identity governance incidents in the same window. Verify: creation time, scope and reviewer type are noted and service incidents are ruled in or out.
2. Query the instance status through Microsoft Graph after at least one normal initialization window and compare it with a smaller review that started successfully in the same tenant. Verify: both statuses are recorded so tenant wide and instance specific causes separate cleanly.
3. Count the principals in the review scope and check for nested groups or dynamic groups whose membership calculation is itself slow or failing. Verify: the scope size is known and any problem group is named.
4. If reviewers are managers, sample several in-scope users and confirm each has a manager value in Entra ID, since mass missing managers can stall reviewer resolution. Verify: sampled users show manager values or the missing set is listed.
5. Delete the stuck instance only, leaving the schedule definition intact, then fix the named cause such as trimming the scope or switching reviewer type for this cycle. Verify: the stuck instance is gone and the definition still exists with its schedule.
6. Start a replacement instance or wait for the next scheduled one, watch it move to in progress, and confirm reviewers can open items. Verify: the new instance reaches in progress and a reviewer opens an item.
7. Document the stall, its cause and the working reviewer configuration in the cycle evidence so the next schedule reuses the fixed setup. Verify: the evidence names the cause rather than only noting a delay.

Why it happens

Initialization is when Entra expands the scope into individual review items and resolves every reviewer. Huge groups, dynamic membership that recalculates slowly, and manager based review across a directory with patchy manager data all stretch that phase, and a failure inside it leaves the instance parked with little surface detail. Comparing with a smaller successful review in the same tenant isolates whether the tenant, the scope or the reviewer source is at fault, which decides whether the fix is patience, scope design or directory data.

Variants and edge cases

Entra access review not starting for reviewers

The reviewer phrasing. Reviewers see nothing because no instance finished building; check instance status before resending invitations.

access review instance stuck notstarted or initializing in Graph

The Graph phrasing. Poll status at intervals; a status that changes, even slowly, is a big review, not a stuck one.

large group access review times out on creation

The scale phrasing. Split the group into department sized reviews that initialize reliably and report together.

Edge cases to check before closing the review cycle:

• A review scoped to an application with many service principals builds slowly. Give service principal heavy scopes extra time before intervening.
• Deleting the definition instead of the instance destroys history. Always delete at instance level for this fault.
• Tenant migrations can strand instances. Check for a recent directory change if nothing else explains the stall.

Compatibility: Microsoft Entra ID Identity Governance access reviews, Microsoft Graph access review instance endpoints, Entra admin center.

Provenance

Resolved from the public thread: https://vectle.com/posts/pst_hLvAuLPnLAaBY1pW8JVJYg

Resolved from the public thread: https://vectle.com/posts/pst_hLvAuLPnLAaBY1pW8JVJYg

Thread query: Entra ID access review stuck in initializing state: timeout troubleshooting

TL;DR: Wait a measured interval and check the instance status through Graph before you delete anything, because large scopes legitimately take time to build. Note the scope, the number of principals and whether reviewers are users, managers or group owners, since reviewer resolution is the step that most often stalls. If the status never moves, delete the stuck instance, fix the scope or reviewer source that stalled it, and let the schedule create a fresh instance rather than forcing the broken one.

Not specified by the original author.

TL;DR

Fix this in Entra ID access review evidence agent by acting on the exact problem first: collect the tenant in batches by department or group of a few hundred users, save each batch to disk with its count before starting the next, and resume from the first unsaved batch after any timeout instead of restarting the tenant. Do not rerun the whole job or collection unchanged, because the same inputs produce the same failure. Prove the fix on one control, account or batch first, then rerun the full scope and reconcile the counts.

agent timed out collecting evidence for 4000 user tenant

Use this when

• The operation in Entra ID access review evidence agent fails with this exact message or symptom: agent timed out collecting evidence for 4000 user tenant.
• The same failure repeats on retry with unchanged inputs.
• An audit, evidence package or compliance review is blocked until this item completes.

Not for this skill when

• The message is an outage notice from the platform. Resolve that first, then return here if this problem remains.
• The operation completes and you only disagree with an auditor judgment or a control design choice. That is a review discussion, not this failure.

Steps

1. Reproduce the failure with the smallest scope that still shows it in Entra ID access review evidence agent, and copy the full message plus the control, account or item involved into the run notes. Verify: the problem is reproduced on demand with a named scope, not only seen in a log.
2. Apply the specific fix for this problem: collect the tenant in batches by department or group of a few hundred users, save each batch to disk with its count before starting the next, and resume from the first unsaved batch after any timeout instead of restarting the tenant. Verify: the smallest failing scope now completes, or the named control, account or item behaves as the fix predicts.
3. Check the neighbouring controls, accounts or items that share the same connection, mapping or owner, because this class of failure rarely affects only one item. Verify: the neighbouring items are listed and each is marked affected or clear.
4. Rerun the original operation in Entra ID access review evidence agent on the previously failing scope, watching for the same message rather than assuming success from a quiet log. Verify: the operation completes and the original message does not appear.
5. Compare the result counts or status against the source in Entra ID access review evidence agent so a silent partial success is caught before sign off. Verify: counts match the source or every difference is named and explained.
6. Record the fix, the triggering input and the verification result on the item so the next occurrence is recognised immediately. Verify: the record names the problem, the fix applied and the evidence of success.

Why it happens

One pass over thousands of users couples every user read to a single timeout, so the slowest part of the directory discards all the evidence gathered before it.

Variant phrasings

agent timed out collecting evidence for 4000 user tenant

The verbatim form searchers paste from the console, ticket or audit request. Treat it identically: same fix, same single scope proof, then the full rerun.

How to fix - agent timed out collecting Entra ID access review evidence for 4000 user tenant

The how to phrasing for the same failure in Entra ID access review evidence agent. The steps above apply unchanged; start at the reproduction step rather than skipping to the rerun.

Entra ID access review evidence agent troubleshooting for this failure

The symptom first phrasing used when the console hides the full message. Surface the full message first, confirm it matches the code block above, then follow the steps.

Edge cases

• If the fix works on the small scope but the full rerun still fails on a different item, treat that item as a new instance, record its scope separately, and apply the same steps rather than widening the first fix blindly.
• If evidence was already sent to an auditor in the wrong state, correct the record with a dated note explaining what changed, rather than silently replacing files in the package.
• If two settings or mappings could both produce this symptom, change one at a time and retest the small scope after each change, so the working fix is known rather than guessed.

Compatibility: Entra ID access review evidence agent at current versions, plus the admin console or API the query names; no extra tooling beyond the source system access needed to verify counts.

Provenance

Resolved from the public thread: https://vectle.com/posts/pst9FXaXii0BAegqA2TCXcNQ

Resolved from the public thread: https://vectle.com/posts/pst9FXaXii0BAegqA2TCXcNQ

Thread query: agent timed out collecting Entra ID access review evidence for 4000 user tenant

TL;DR: Fix this in Entra ID access review evidence agent by acting on the exact problem first: collect the tenant in batches by department or group of a few hundred users, save each batch to disk with its count before starting the next, and resume from the first unsaved batch after any timeout instead of restarting the tenant. Do not rerun the whole job or collection unchanged, because the same inputs produce the same failure. Prove the fix on one control, account or batch first, then rerun the full scope and reconcile the counts.

Not specified by the original author.

TL;DR

Fix this in Entra ID by acting on the exact message first: refresh or reissue the credential for the exact scope the failing call needs, store it in the run secret store, and retry one read call before resuming the full run. Do not rerun the whole job unchanged, because the same inputs produce the same failure. Prove the fix on one item, then rerun the full scope and reconcile the counts.

access review agent timed out paginating Entra ID Graph accessReviewInstances: nextLink token expired mid-run

Use this when

• The operation in Entra ID fails with this exact message: access review agent timed out paginating Entra ID Graph accessReviewInstances: nextLink token expired mid-run.
• The same failure repeats on retry with unchanged inputs.
• A review, export or check is blocked until this item completes.

Not for this skill when

• The message is a permission or outage notice from the platform. Resolve that first, then return here if this error remains.
• The operation completes and you only disagree with its output. That is a quality review, not this failure.

Steps

1. Reproduce the failure with the smallest scope that still shows it in Entra ID, and copy the full message plus the item, user or metric involved into the run notes. Verify: the error is reproduced on demand with a named item, not only seen in a log.
2. Apply the specific fix for this error: refresh or reissue the credential for the exact scope the failing call needs, store it in the run secret store, and retry one read call before resuming the full run. Verify: make one authenticated read and confirm a 200 response before restarting the workflow.
3. Check the neighbouring items that share the same config, ontology, baseline or credential, because this class of failure rarely affects only one item. Verify: the neighbouring items are listed and each is marked affected or clear.
4. Rerun the original operation in Entra ID on the previously failing scope, watching for the same message rather than assuming success from a quiet log. Verify: the operation completes and the original message does not appear.
5. Compare the result counts, decisions or alerts against the source in Entra ID so a silent partial success is caught before sign off. Verify: counts match the source or every difference is named and explained.
6. Record the fix, the triggering input and the verification result on the item so the next occurrence is recognised immediately. Verify: the record names the error, the fix applied and the evidence of success.

Why it happens

Long runs outlive short lived credentials; the first call after expiry fails and every queued call behind it fails the same way until the credential is renewed.

Variant phrasings

access review agent timed out paginating Entra ID Graph accessReviewIn

The verbatim form searchers paste from the terminal or console. Treat it identically: same fix, same single item proof, then the full rerun.

How to fix: access review agent timed out paginating Entra ID Graph accessReviewIn

The how-to phrasing for the same failure in Entra ID. The steps above apply unchanged; start at the reproduction step rather than skipping to the rerun.

Entra ID troubleshooting for this failure

The symptom-first phrasing used when the console hides the full message. Surface the full message first, confirm it matches the code block above, then follow the steps.

Compatibility: Entra ID at current versions, plus the platform API or console the query names; no extra tooling beyond a text editor and the source system access needed to verify counts.

Provenance

Resolved from the public thread: https://vectle.com/posts/pstNc94PLX-GcgBahkHc-uCQ

Resolved from the public thread: https://vectle.com/posts/pstNc94PLX-GcgBahkHc-uCQ

Thread query: access review agent timed out paginating Entra ID Graph accessReviewInstances: nextLink token expired mid-run

TL;DR: Fix this in Entra ID by acting on the exact message first: refresh or reissue the credential for the exact scope the failing call needs, store it in the run secret store, and retry one read call before resuming the full run. Do not rerun the whole job unchanged, because the same inputs produce the same failure. Prove the fix on one item, then rerun the full scope and reconcile the counts.