Technical Review
Who really has access to what?
Most organisations know what their access management is supposed to do. Fewer know what is actually recorded in AD, Entra ID, the HR system, and the line-of-business applications. A Technical Review reads the entitlements straight out of the sources, links them together, and shows the gap between what you believe and what is there – with numbers you can put in front of management and the auditors.
When does it make sense?
Signs that you are missing the real picture
- The auditors asked who has access to a system, and the answer took a week of spreadsheet work.
- You have an IGA platform, but you cannot see what has been granted outside it.
- Former employees turn up with active accounts long after offboarding was completed.
- Administrator rights and service accounts have grown, and no one can say why.
- You are facing an IGA project, an AD migration, or a merger, and want to know the starting point before you move anything.
- NIS2 or ISO 27001 requires you to document access management, not just describe it.
The engagement
From read access to a prioritised list
- Scoping
We agree which sources to include, who owns them, and what management or the auditors need answered. Typically the HR source, AD, Entra ID, your IGA platform if you have one, and the most important line-of-business applications.
- Connection
The sources are connected to an analytics platform with read access only. No changes to your systems and no agents on workstations. Identities and accounts are linked across the sources, so each person appears only once.
- Analysis
A set of standard controls gives the first picture: orphaned accounts, privileged entitlements, accumulation, segregation of duties, and data quality. Our consultants then review what the controls do not catch: patterns in your role model, deviations between IGA and target system, and the accounts no one owns.
- Report and review meeting
You get the report with the numbers, a clean-up list in the order it can be carried out, and evidence that can be handed to the auditors. We go through the results with you and recommend next steps, which you are free to take yourselves or with us.
What you get answered
Eight questions with numbers behind them
- Orphaned accounts: how many accounts belong to no active employee, and in which systems?
- Privileged accounts: who holds administrator rights, and how many of those are personal, shared, or service accounts?
- Entitlement accumulation: which employees still hold access from previous positions that was never removed?
- Identity hygiene: how many people hold several accounts, and how many accounts cannot be tied to a person?
- Role hygiene: which roles and groups are empty, outdated, or identical to others?
- Data quality: where do the HR system and the access systems disagree, for example on department, manager, or leaving date?
- Segregation of duties: which combinations of entitlements should no one hold at the same time, and who holds them anyway?
- Deviations from IGA: what has been granted outside your IGA platform, and which systems does it not know at all?
Next step
A review is a snapshot. The overview can stay.
Many organisations choose to leave the analytics platform in place after the review. The sources are reloaded daily, every control builds history, and managers and application owners can run access reviews themselves instead of receiving a spreadsheet.
The platform changes nothing in your systems on its own. Decisions to remove access are sent as tickets to your service desk or IGA platform, which carries out the change. That keeps the responsibility where it belongs and gives an audit trail from decision to execution.
If you already have an IGA platform, the overview sits on top of it and shows what the platform cannot see itself: access granted outside the flow and systems that were never connected. If you have none, it is a lightweight form of governance that is up and running in weeks.
Read about Managed ServiceA continuous overview
- Daily reloads and history on every control, so the trend can be followed.
- Access reviews driven by the owners rather than by the IT department.
- Changes as tickets to your ITSM tool or IGA platform.
- Run by you or as part of our Managed Service.
Three ways to look at access management
Technical Review, Healthcheck, or Maturity Assessment?
The three reviews look at different layers and complement each other. A Technical Review supplies the numbers behind a healthcheck finding and the starting point for an assessment roadmap.
| Technical Review | IAM Healthcheck | IAM Maturity Assessment | |
|---|---|---|---|
| Looks at | Identities and entitlements in your systems | Your IAM solution: platform, configuration, integrations | Your organisation: processes, governance, maturity |
| Method | Read access to the sources and automated controls | Technical review of the solution and interviews | Interviews, documents, and a maturity model |
| Answers | Who really has access to what? | Is the solution running as it should? | Where do you stand, and what is the next level? |
| Requires an IAM solution | No | Yes | No |
| Result | Numbers, evidence, and a clean-up list | Prioritised improvement list | Gap analysis and roadmap |
If you want all three, we start with the review: a finding is easier to explain when the number is already there.
Our view
A review built on interviews tells you what people believe. A review built on data tells you what is there.
We do both, but we start with the data, because behind the data are the accounts and entitlements attackers log in with.
When did you last see your entitlements as they actually are?
We agree the scope after a short scoping conversation, and the report and the clean-up list are yours, whatever you choose to do afterwards.