Entra ID access review auto-apply results failed with error "target object not found"

TL;DR

Turn auto-apply off while you investigate, so a broken scope does not keep generating silent failures each schedule. List the objects the review was scoped to, group members, application assignments or role holders, and find which targets were deleted, moved or had their identifiers changed since the review started. Apply the deny results manually for the still existing targets with a second person checking, clean the scope definition, and re-enable auto-apply only after a small test review applies cleanly.

target object not found

Use this when

• A completed review shows apply errors for some or all results.
• Denied users keep access that the review said should be removed.
• The scope group or application changed membership type mid-review.

Not for this skill when

• Reviewers approved everything, so there is nothing to apply. That is a normal outcome, not an error.
• The review itself is stuck before completion. Resolve the review state first.

Steps

1. Open the completed review results and the apply status details, listing each target object that returned not found with its type and identifier. Verify: every failed target is listed with type and identifier.
2. Search for each failed target in the directory and classify it as deleted, renamed, moved to another scope or converted, for example a group changed to dynamic membership. Verify: each target classification is recorded.
3. For targets that still exist under a changed identifier or location, apply the deny outcome manually by removing the group membership or assignment the review intended, with a second admin verifying one sample. Verify: manual application succeeds for the existing targets and the sample is verified.
4. For truly deleted targets, record the item as moot with the deletion evidence, since there is no access left to remove. Verify: deleted target items carry a documented moot closure.
5. Edit the review definition scope to remove dead objects and replace moved objects with their current references, and check the scope membership count against expectations. Verify: the definition scope contains only resolvable objects.
6. Run a small test review on a contained scope with auto-apply enabled, deny one test item, and confirm the result applies without the target error. Verify: the test review applies its result cleanly.
7. Re-enable auto-apply on the main definition if the test passed, and file the manual applications and scope cleanup in the cycle evidence. Verify: auto-apply state and the manual work are both documented.
8. Add a weekly scope health check for definitions that use auto-apply, listing scope objects that were deleted or moved since the last check, so the scope is repaired continuously rather than at completion time. Verify: the check runs weekly and a deliberately moved test object appears on its output.

Why it happens

Auto-apply runs days or weeks after a review starts, against a directory that kept changing in the meantime. Groups get deleted, applications are re-registered, and objects move, so the applier faithfully reports that its targets are gone. The review decisions are still valid and often still needed for the objects that merely moved, which is why manual application with verification comes before scope cleanup. Treating deleted targets as moot closures, rather than failures, also keeps the completion statistics honest for auditors.

Variants and edge cases

Entra auto apply results failed access review deny not removed

The outcome phrasing. If denied access remains, apply manually now and clean scope after; do not wait for the next cycle.

access review apply error group deleted

The group phrasing. Deleted scope groups take their pending results with them; document and re-scope.

target object not found on review completion

The completion phrasing. Sample several targets; a mix of moved and deleted is normal in a long review window.

Edge cases to check before closing the review cycle:

• Dynamic groups recalculate membership, so a deny applied to group membership may reappear. Apply at the assignment level for dynamic scopes.
• Application deletion removes access entirely. Confirm before marking moot that no replacement application carries the same access.
• Keep auto-apply off through one full clean cycle if the directory is mid migration.

Compatibility: Microsoft Entra ID access reviews with auto-apply results, directory object lifecycle, Microsoft Graph review result endpoints.

Provenance

Resolved from the public thread: https://vectle.com/posts/pst_emsV2vDSlPPtJKmCHpO1Zw