User Access Review · Niramayee Sarpotdar

Every organization collects access debtPeople join, switch teams and leave. The permissions they were granted rarely follow them. A finance folder meant for 12 people ends up open to 200, including people who left years ago.

A user access review is the periodic audit that fixes it.

Regulations require proof that someone with authority regularly reviews who has access, and keeps or removes it on purpose.

SOXGDPRHIPAA

Rarely a one-person job

Compliance officerOwns the deadline

ManagerCertifies their team’s access

Data ownerCertifies who sees their files and databases

ITExecutes the revocations

Excel template used for manual user access reviews, showing user names, systems, permissions, and decision columns. — How reviews are done today: one spreadsheet, hundreds of rows.

PainpointsSix ways a manual review breaks

Access is scattered

Every tool keeps its own list.

Pulled by hand

Exports are stitched into spreadsheets that go stale right away.

Endless chasing

Reminders by email, answers tracked in someone’s inbox.

Nobody’s sure who decides

The person asked rarely knows if the access is still justified.

Rubber-stamped

Under deadline, everything gets approved and nothing is removed.

Hard to prove

When the auditor asks, the trail is rebuilt from scratch.

GoalsSpend time on the decisions that matter

01 EfficiencyFewer but more meaningful decisionsA reviewer should spend their time on the actual decisions that matter, not 400 that don’t.

02 AccuracyContext at every decisionEnough data to decide correctly and reduce risk.

03 FlexibilityOne tool, many workflowsWorkflows that fit each team’s requirements.

04 CollaborationTeams work in one placeAn easy way for different teams to work together.

ApproachTemplates set the rules. Reviews follow them.

A finance folder may need two rounds of approval, while an engineering folder may not. Admins create a template for each kind of review.

Set up per review type · Admin Each template answers 4 questions

Who’s asked Managers, owners, the users themselves

In what order Who goes first, who confirms

If nobody answers Escalate, remind, or default

Who signs off And who gets the final report

↓ Each review follows its template

01Admin Picks the scope A folder, drive, site or connected app.

02LightBeam Lists who has access Every user, group and link, and how they got it.

03People asked Attest Users, their managers or a designated reviewer confirm the need.

04Reviewer Decides Keeps or removes each grant, with the attestation in view.

05Approver Signs off LightBeam executes removals and produces the audit report.

Recurrence Re-runs on a schedule. Later reviews show only what changed, not everything again.

Solution

01 / WORKFLOW

Define how the review should be done and by whom

The workflow is a set of blocks which tell the system what needs to happen at every stage and who is responsible for what actions.

02 / REVIEW

Create review and select scope

The folder, drive, site or app which the user wants to review along with the workflow they want to use for the review.

03 / DECISIONS

Attestation and access control

Users, reviewers, managers, etc. can accept or reject their access or decide to revoke access for users or groups who don’t need it. An authorized person can sign off once all attestations are complete and mark the review as done.

Where it landedWhat I would have measured

I left LightBeam just as this feature rolled out, so I can’t point to customer or POC numbers. I do know what I would have measured. The two goals, efficiency and accuracy, can pull against each other.

EfficiencyFaster reviewsReviewers want to finish more reviews, faster. On its own, that can mean rubber-stamping.

AccuracyMore revocationsMore access removed suggests reviewers are actually scrutinising the data.

Faster reviewsMore revocationsthe design worked

Both moving together is what I would have tested to validate the design.