Begin with authority, not a spreadsheet
An access review should answer whether the right identities can perform the right actions for a valid business reason. Define which systems and privileges matter most, who can confirm the need and what evidence will support each decision. Start with administrators, financial approvers, remote-access users, shared identities and access held by suppliers.
System owners understand technical roles; managers understand current responsibilities; security teams understand concentration and attack paths. Bring those views together instead of asking one person to certify a list they cannot interpret.
Find the identities that ordinary reviews miss
Include service accounts, application registrations, API keys, emergency accounts, delegated mail access and groups that grant indirect privilege. Compare identity sources with human-resources and supplier records to identify departed users, role changes and accounts with no accountable owner.
Dormancy is a useful signal but not an automatic deletion rule. Some recovery or seasonal accounts are rarely used by design. Record the purpose, owner, protection and review date for every justified exception.
Reduce standing privilege safely
Use the least-privileged role that supports the task, separate administrative activity from ordinary work and prefer time-bound elevation where the platform supports it. Test changes and maintain controlled emergency access so risk reduction does not create an avoidable outage.
After remediation, validate that access actually changed and that no alternate group, token or application permission recreates the path. Monitor privileged assignment and authentication events, then repeat reviews on a cadence shaped by risk and organisational change.
What to do next.
- ✓Define high-impact systems and privileges.
- ✓Include human, service and application identities.
- ✓Give every exception an owner and expiry date.
- ✓Separate administrative from daily-use accounts.
- ✓Validate removal and indirect access paths.
- ✓Monitor and repeat after material change.
Use guidance responsibly
Technology, provider behaviour and legal requirements change. Validate implementation details against current official documentation, test changes safely and obtain qualified legal advice where required.
Maya Naidoo
Identity & Cloud ContributorWrites about identity architecture, cloud access and the controls that make distributed systems easier to trust and operate.
More from this writer