Access Certification That Leads to Action

1. Choose a meaningful review boundary

A certification is not the same as an assessment questionnaire. It examines existing access and asks an authorised person whether that access remains justified. Start with an application, role population or business concern that can be described clearly. A campaign labelled “all access” can conceal exclusions that materially affect its conclusion.

Identify the accounts and entitlements in scope, the collection time and any known coverage limits. A stale export may miss recent grants. A review of directory groups may not cover direct application assignments. Resolve these differences or explain them before asking reviewers to make decisions.

Microsoft’s access-review guidance describes recurring reviews of memberships, application access and role assignments. It also emphasises involving resource owners. The practical objective is continued justified access, not simply a completed campaign. Microsoft Learn: What are access reviews?.

2. Give reviewers information they can use

Technical labels often hide business meaning. Translate a permission such as an internal group identifier into the action it allows, the application it affects and its owner. The reviewer should know whether the person can view information, change it or authorise a transaction.

Check the limitations of usage information. No recorded activity is not proof that an account is unnecessary if logging is incomplete or the task is seasonal. Conversely, recent use does not prove that the access is authorised. Context helps the reviewer ask a better question; it does not replace business ownership.

Give reviewers a route to obtain clarification. For Mariner, a manager may know the person’s job while the finance-application owner understands the permission. The review design should connect those perspectives rather than forcing either person to guess.

3. Use AI recommendations as reviewed proposals

A recommendation can focus attention on unusual permissions or suggest a decision based on available patterns. Explain which information contributes to the suggestion and where information is missing. Reviewers should be able to disagree and record why.

Peer similarity can be helpful, but a common permission is not automatically appropriate. If many employees retained an obsolete permission, learning from that population may reproduce the mistake. Check sensitive entitlements against business purpose and policy even when a recommendation looks routine.

IGAX’s website describes access certification with recommendations and risk-based prioritisation. Its analytics capabilities can provide context for reviews. The operating model should define which decisions need a person’s judgement and which narrowly defined cases may follow an approved automated rule. IGAX platform capabilities.

At Mariner, a routine read-only permission might be handled differently from payment release. Define that distinction before launch. Avoid using the absence of an alert as the only justification for keeping consequential access.

4. Plan for silence and disagreement

Reviewers may be unavailable, permission owners may be unknown and two reviewers may disagree. Define the escalation route and the treatment of unanswered items. No response should not quietly become a positive business decision unless an explicitly approved policy calls for that behaviour and its consequences are understood.

For an uncertain item, record the question and who must resolve it. If a reviewer says that an employee needs access for a handover, ask for the handover period and accountable sponsor. The campaign can then distinguish justified temporary retention from indefinite access.

• Name an owner and backup for each review population.
• Define the deadline, reminders and escalation route.
• Require a reason for material exceptions and disputed decisions.
• Keep undecided access visible after the campaign deadline.

Measure the workload before asking one manager to review hundreds of unfamiliar permissions. Pilot the campaign with a small group and examine the questions they raise. Improve the permission descriptions and routing before expanding the audience.

5. Follow the decision into the application

A revoke decision is an instruction to change access. It is not proof that the change occurred. Track the request, execution result and resulting entitlement state. A connector failure or application-local assignment may leave access in place after the reviewer has finished.

At Mariner, a decision to remove payment release should be checked against the effective permissions in the finance application. If the same access remains through another group, the original removal has not achieved the intended outcome. Ask the application owner to resolve the remaining path.

A campaign may finish its decision phase while some actions remain open. Report those states separately. This makes the completion figure honest and gives the operational team a clear queue of work.

6. Improve the next cycle

Review why decisions were difficult. Repeated clarification about one entitlement suggests the catalogue needs work. Repeated temporary exceptions may indicate that the baseline role does not fit the job. Repeated revocation failures point to an integration or operating-process problem.

Track a small set of measures: coverage of the intended population, unresolved decisions, changes awaiting execution and verified removals. Record the reporting date and definitions. A faster review is useful only if it preserves the quality of the decisions and resulting actions.

Keep the final campaign record understandable to someone who did not attend the review meetings. It should explain the scope, decision process, operational outcomes and limitations. That record supports future reviews without implying that one campaign proves all access is correct.