Skip to main content

​
What is an Access Review?

Access Reviews are routine assessments to ensure employees have the appropriate access to applications based on their job requirements. Typically conducted by line managers or business owners, these reviews aim to:
  • Confirm or adjust existing access permissions.
  • Downgrade permissions if needed.
  • Revoke access if no longer required.
Access Reviews enhance security and compliance, ensuring access aligns with organizational policies.
Access Reviews are essential for maintaining security and compliance. Regular reviews ensure that employees only have the access necessary for their roles, supporting certifications like SOC-2, ISO 27001, and HIPAA.

​
Setting Up an Access Review Campaign

  1. Navigate to Access Reviews.
  2. Create a new Access Review, selecting the applications in scope.
  3. Assign reviewers:
    • Managers for direct reports.
    • Business Owners for users within specific applications.
    • Specific Reviewer to assign a single person to run the entire review, instead of managers or business owners.
You can run multiple campaigns simultaneously. To start a campaign, click the play icon. Review campaign results by selecting the campaign title. Once completed, download results as a CSV under the “Historic Access Review Campaigns” tab.
You can cancel a pending campaign with the Cancel campaign button on the current campaign view. A cancelled campaign moves to a distinct Cancelled status on the access review overview.
Vanta users can set up an integration with Vanta to automatically sync completed Access Reviews with their Vanta account.

​
Assigning Different Reviewers per Application

A campaign is set up with one reviewer basis, but you can hand individual applications to different people. On the campaign view, open Reassign reviews of reviewer and:
  1. Pick the Current Reviewer whose items you want to move.
  2. Choose the Replacement Reviewer who should take them over.
  3. Optionally use Restrict to Applications to move only specific applications (one or several). Leave it empty to move all of that reviewer’s items.
This lets different applications in the same campaign be reviewed by the right owner. A common pattern is to review some applications yourself first, then reassign the rest to their business owners on a per-application basis.

​
Performing an Access Review

As a manager, you’ll review access for your direct reports. You’ll receive a Slack notification with estimated review time.
  1. Click the provided link in your notification.
  2. For each user, decide:
    • Should they retain access to the application?
    • Is their current permission level appropriate, or can it be reduced?
  3. Submit the review for each application by clicking Submit.
Access changes are automatically applied.
If an application doesn’t need attention, you can skip it directly from the access review screen to move on to the next item.

​
FAQ

By default, reviewer-made changes bypass normal approvals. If your application uses manual provisioning, the Application Admin can still review and approve or deny changes before they take effect. If it’s automated provisioning, those changes are applied immediately. To prevent managers from granting critical roles, make the business owner the reviewer.
Yes. You can add or change a user’s access while an application is in the Access Review phase. The change does not appear in or affect the running review, because a review is locked to the snapshot of access taken when the campaign started.To have the newly added access reviewed, complete or cancel the current review and start a new one. The new review picks up the current state of access and includes it. This also means a reviewer cannot pull a missing user into a review that is already running, that access becomes reviewable in the next review.
Because the application is actively under review, any change to access needs an explicit, auditable confirmation that the reviewer intended to make that change. Only existing access can be confirmed, changed, or revoked. This prevents accidental or unauthorized privilege changes during a sensitive stage and preserves a clean audit trail for compliance and security purposes.
Users marked as Executive in AccessOwl review their own access in manager-based campaigns.
Selecting Confirm on a row saves that row on its own, so every row can read Confirmed while the review is still open. The review only closes when the reviewer clicks Submit this application & complete at the bottom of the application. Until then their task stays open, reminders keep going out, and the campaign never reaches 100%.You can spot an unsubmitted reviewer in the Reviewers with pending reviews panel, and by the - in the Reviewed column next to their name, which gets a date and timestamp once the submit goes through.If the reviewer can no longer submit themselves, for example because they were offboarded partway through the campaign, open Reassign reviews of reviewer (the pencil next to their name), choose a Replacement Reviewer, and have that person submit the remaining items.
Access changes from a review are applied immediately after an application is submitted. They do not wait for the other applications in the campaign to be reviewed.