KeySkopeWhat is a SaaS access review?
A SaaS access review checks whether application accounts and their permissions remain appropriate for the work they support. The output is a set of justified decisions and verified follow-up actions, not simply a spreadsheet of enabled users.
Start with a specific scope: one production application, its local and federated accounts, and the review period. A narrow review with explicit limitations is more useful than a broad claim that every account has been checked when the source only exposes console administrators.
Prepare an evidence record
For each account, capture the application and environment, source identifier, email or display name if available, enabled status, role or permissions, accountable owner, latest collection time and application activity if supported. Keep the reviewer, decision, reason and follow-up reference alongside that evidence in your approved review system.
Use account identifiers to distinguish records. Similar display names can belong to different accounts, and a changed email address can complicate an identity match.
Prioritise questions that change the decision
- Leavers: does an inactive identity still have an enabled application account?
- Privileges: does the account need its current administrative role?
- Ownership: can someone explain an account that has no matched identity?
- Activity: does old recorded activity warrant a closer look?
These are investigation starting points. A service account may be legitimate, an emergency account may be intentionally quiet, and a recently connected source may have incomplete history.
Example: reviewing a quiet administrator account
Suppose a source reports an enabled administrator account with its last recorded activity 124 days ago. First establish what that timestamp measures. Ask the owner whether the role is required for routine work, emergency recovery or an integration. If a lower role is sufficient, obtain the appropriate approval and make the change in the application.
Then collect the source again. Record that the account now has the approved role. The old timestamp alone is not a reason to delete an account; the business purpose and the verified follow-up complete the review.
Close the review without hiding unresolved work
Separate completed decisions from unresolved ownership, unsupported activity and failed collections. Give each open item an owner and a next step. Keep exceptions visible rather than treating missing data as a pass.
KeySkope helps inspect collected accounts and roles. Use your existing approval and tracking process to record decisions. For a reusable record structure, see the access review evidence guide. For source limitations, read how connectors work.
Continue your review
Explore the IGA and AI access governance library, check connector coverage or read the documentation.