Access Reviews: Certify Who Has Access
An access review records whether each current member still needs their access. It preserves the roster and access details from the start of the review, so later membership changes do not silently rewrite the evidence.
Owner, Admin, Identity Admin, and Security Admin can conduct reviews. Auditor can read them. Open Governance → Access → Access reviews.
Start and conduct a review
- Choose Start access review. An Organization can have one open review at a time.
- Inspect each member's recorded role, Team access, authentication posture, and available last-activity information.
- Mark the entry Approved or Needs action.
- For Needs action, add a note describing what must change and who will follow up. Notes are optional for approved entries.
- Decide every entry, then choose Complete review.
Use a clear note such as "Remove access to the Finance Team after the reporting handover; Maya to confirm by Friday." A missing activity value is not proof that the person never used the product; review the available evidence and business need together.
Carry out the changes separately
Marking an entry Needs action does not change the person's role, remove their membership, or revoke sessions. Perform the required change in People & roles, Teams, session controls, or the relevant integration, then verify it.
The review is a snapshot rather than a live copy of the roster. Check current membership before making a change if someone joined, left, or changed responsibilities during the review.
Complete and retain evidence
Every entry needs a decision before completion. A review can be completed with Needs action entries; completion records that the review was decided, not that all remediation work finished. Keep any outstanding actions in your team's follow-up process.
Completed reviews cannot be edited. Start a new review for the next review period or a later reassessment. Use security activity alongside the review to verify the membership and policy changes that actually occurred.