How to Run an Access Review (Without Drowning in Spreadsheets)
The annual ritual
Your auditor mentions access reviews. Your CISO mentions access reviews. Your last security questionnaire from a customer mentions access reviews. Two months later you're sitting in front of a 4,000-row spreadsheet of "User, Application, Permission, Last Used."
You email it to managers. Half respond. Half of the responses are "I think it's fine." You compile the answers. You write a summary. You file it. You hope the auditor doesn't dig too deep into the methodology.
Sound familiar?
Access reviews don't have to be like that. They're a useful exercise when run properly. The trick is scope, cadence, and a way to make managers actually do them.
If you specifically need the SOC 2 angle on this, there's a separate post for that. This one is the generic version.
What an access review actually is
An access review is a periodic check. Designated people (usually managers or application owners) confirm that the access their team has is still appropriate.
It's not an audit. It's not a security investigation. It's a "look at this list of permissions and tell me if anything looks wrong" exercise.
Three reasons companies do them. First, compliance. NIS2, ISO 27001, SOC 2 all expect it. Second, security hygiene. Access accumulates over time. Reviews force a cleanup. Third, license cost. Reviews surface people who don't actually use what they're paying for.
The mistake is treating access review as a once-a-year event for everything at once. That's the spreadsheet death march. The better approach is small, frequent, scoped.
Scope first
Don't review everything. Pick high-risk slices.
Privileged accounts. Anyone with Global Admin, User Admin, billing roles, or Privileged Role Administrator. There should be very few of these. Review quarterly.
Sensitive data access. Finance shares, HR data, customer data exports, anything with payment information. Whoever has access should justify it. Review quarterly.
Stale users. Anyone who hasn't signed in for 90+ days but is still licensed and grouped. They're either on long leave, gone, or dormant. Review monthly if you can. Quarterly at minimum.
Externals. Guests, contractors, vendor accounts. These should expire by default. They rarely do. Review quarterly.
Everything else (regular employee access to standard apps) can go once a year. The 80/20 lives in the high-risk slices.
Cadence
Set the cadence at the start of the year. Block calendar time. Don't make it ad-hoc.
A workable rhythm for a 200-person company:
Monthly: stale user check. 15 minutes. Anyone who hasn't logged in for 90 days gets flagged for their manager.
Quarterly: privileged accounts review. Two hours total. Every admin role gets reviewed by the security lead. Every Conditional Access exclusion is checked. Every guest account over 90 days old gets a "still needed?" prompt.
Annually: full review. A half-day commitment per manager. Each manager confirms their team's group memberships and SaaS app assignments.
That schedule passes most audits and doesn't take a week of someone's life.
Make it doable for the reviewer
The reviewer (usually a manager) is not an IT person. They don't know what "M365 E5" means. They don't care that "Salesforce-Standard" is different from "Salesforce-Lightning-Power-User."
Translate before you ask. Compare the two framings.
Bad: "User: Anna Karlsson. Application: AAD-RBAC-Sales-VP. Granted: 2024-03-15."
Good: "Anna has the same Sales VP access as everyone else in your team."
Give them a clear question. Not "is this appropriate." Try "is Anna still on your team and still doing the same job? Yes / No / Changed roles."
Make it three clicks max. If the review takes more than 10 minutes per direct report, the manager will skim and approve. That's worse than not running the review at all. Now you have documented approval for everything wrong.
Document the result
Whatever you found, write it down. Who reviewed what. What changed. What stayed. The dates. This is the audit trail. Without it, the review didn't happen as far as the auditor is concerned.
Two practical formats that work:
A simple spreadsheet (yes, sometimes a spreadsheet is the right tool). One row per review event. Columns for reviewer, scope, findings, remediation.
A ticket in your service desk system with the same fields. Has the benefit of timestamps and an audit log built in.
Whichever you pick, be consistent. Same format every quarter. Auditors love consistency.
Where Adcyma fits
Full transparency: this is our product. Adcyma runs access reviews as a built-in workflow. Manager-readable language, three-click approvals, full audit log, exports for whichever framework you're being audited against. Free for up to 25 users.