User access review: the admin nobody listed

The quarterly access review goes out to managers on the first of the month. Each manager gets a list of their team’s apps from the identity provider and marks every name “keep”. The review closes on time.

Two years ago, a contractor created an admin account directly in the ERP, outside single sign-on. It was never on the list, so nobody reviewed it.

User access review is the part of compliance automation that checks who still needs what. It only covers the access it can see.

What is a user access review?

A user access review checks, on a schedule, that everyone with access to each in-scope app still needs it. A reviewer who knows the work confirms or removes each person’s access. Access marked for removal is removed, and the removal is logged.

Why reviews miss access

1. The list comes from single sign-on. Accounts created inside an app, and service accounts, never appear.
2. Reviewers approve everything. A manager sees forty names and marks every one “keep”.
3. Removal is a separate ticket. A “remove” decision becomes a request to IT, and it waits.
4. Reviews run on a spreadsheet. Lists are exported, emailed, edited and merged by hand.
5. Movers keep their old access. Someone who changed teams last quarter still has their old team’s apps.

What it costs

The access that matters most, admin accounts and accounts outside single sign-on, is the access the review doesn’t see. Removals that wait leave former contractors with access after the review says it’s gone. Auditors test the removals, and a delay is an exception.

What to fix first

1. Pull each app’s own user list. Compare it with the identity provider, and flag any account that exists only in the app.
2. Show reviewers how the access is used. Last sign-in and role tell them whether it’s still needed.
3. Remove access when the reviewer says so. The decision runs the removal, and the result is logged.
4. Review in chat. Managers keep or remove from Slack or Teams, one person at a time.
5. Put movers first. Anyone who changed role since the last review goes to the top of the list.

The guide to building a user access review has the prompts for each step.

Where it fits

Most of what a review removes is access left over from a role change, which joiner, mover, leaver is meant to catch. Access to AI tools and MCP servers needs the same check, covered in MCP access reviews. Each completed review is evidence for audit evidence collection.

For every part of compliance automation, from policy to audit evidence, see continuous compliance.