User Access Reviews & Certification
Proves the right people still have the right access.
Overview
Access certification is the periodic campaign where an owner confirms, line by line, that each person still needs each entitlement — and revokes what they do not. It is a named requirement in SOC 2, ISO 27001, PCI DSS and SOX ITGC, and the control most often failed on evidence rather than intent: the review happened, but nobody can show who approved what, or that the revocations were actually applied. Full IGA suites do this alongside provisioning and role management; a growing set of lighter tools do certification alone, faster and far cheaper.
A named control in every major framework, and the one where evidence most often falls apart.
Advantages
- Directly satisfies a control named in SOC 2, ISO 27001, PCI DSS and SOX ITGC
- Catches the access nobody removed after a transfer — the quiet accumulation that privilege creep is made of
- Closed-loop revocation proves the decision was executed, not just recorded
- Micro-certifications triggered by role change beat annual campaigns for both accuracy and fatigue
- Reviewer sign-off with an audit trail is exactly the artifact an assessor samples
Trade-offs
- Rubber-stamping is endemic — reviewers approve everything under time pressure and the control is worthless
- Only covers applications you connected; unintegrated SaaS stays invisible
- Full IGA suites are expensive and slow to deploy for what is often a certification-only need
- Entitlement names are frequently meaningless to the business owner asked to approve them
- Annual campaigns leave an eleven-month window that attackers do not respect
Open-source option
midPoint (Evolveum) is a genuine open-source IGA platform with certification campaigns, and Keycloak plus scripted extracts can produce a defensible manual review. Neither gives you the SaaS connector breadth, the reviewer experience, or the closed-loop revocation evidence that makes a campaign survive an audit sample without manual reconciliation.
Vendors & tools in this area
Access reviews inside the Microsoft identity stack.
Visit site →Certification campaigns evidenced against the control framework.
Visit site →