User Access Reviews

User access reviews (UARs), also called access certifications, are a periodic audit of who has access to what within an organization's systems and applications, and whether that access is still appropriate. Reviewers (typically managers, resource owners, or security teams) confirm each user's access is justified, then approve, modify, or revoke it. UARs are a core control for least-privilege enforcement and are typically run quarterly or semi-annually, though risk-based or continuous models are increasingly replacing fixed calendar cycles.

The identity lifecycle is the sequence of state changes an identity goes through inside an organization: provisioning at hire, entitlement changes at every role, team, or status change, and deprovisioning at departure. Each stage represents a moment where access should be re-evaluated against current need. In practice, the lifecycle rarely runs in a straight line. People move teams, take on temporary projects, get promoted, go on leave, and return, and each of those transitions is a separate event that access needs to track.

Access is usually correct at the moment it's granted. It's the transitions afterward, such as role changes, team moves, project endings, and terminations, that create misalignment. Because entitlements don't automatically shrink or shift when a person's status does. A role change adds new access far more reliably than it removes old access, while termination revokes access in the systems someone remembers to check and leaves it standing everywhere else. Risk isn't a constant background level; it spikes at these transition points and then quietly persists until something forces a review.

Access drift is the gap between what someone is entitled to and what their current role actually requires. It builds up incrementally: a person picks up access for a project, changes teams, gets promoted, covers for a colleague, and the old entitlements are rarely cleaned up along the way. Over time, most identities in an organization accumulate more access than their job function justifies, which is exactly the standing-access exposure that shows up in breach investigations and failed audits.

Access reviews run on two tracks: scheduled campaigns (typically quarterly) that sweep all in-scope systems, and event-driven reviews tied to joiner/mover/leaver events — verifying appropriate access at hire, cleaning up leftover entitlements after a role change, and revoking access immediately at offboarding. Relying on scheduled reviews alone leaves gaps between cycles where inappropriate access can sit unnoticed. Organizations using just-in-time access reduce this burden further, since access is granted only when needed and expires automatically, preventing standing privileges from accumulating in the first place and shrinking what reviewers have to check each cycle.