Your SaaS stack grows faster than your ability to audit who has access to what, leaving orphaned accounts and excessive privileges invisible until an auditor asks.
Manual access reviews are a tax on growth. You add Slack, then Figma, then Notion, then a dozen more tools—and suddenly your IT team is copy-pasting user lists into spreadsheets every quarter, hoping they don't miss anyone. By Q4, you've got contractors with admin access to apps they left six months ago, and your auditor is asking questions you can't answer fast. This workflow automates the entire cycle: pull access lists from your SaaS stack on a fixed schedule, route them to the right manager for certification ("Is this person still supposed to have access?"), flag accounts that haven't been touched in 90 days, and generate a compliance report you can hand to your auditor without apology. The workflow runs on a quarterly trigger (or monthly, if you're paranoid). It pulls user rosters via API from each app—Okta, Google Workspace, GitHub, Slack, Figma, whatever you use. It groups access by manager (the person who hired the user or owns the team), sends them a structured review form, and flags anything unusual: new access grants, inactive accounts, privilege escalations, or accounts missing from your HRIS. Managers approve or reject each access grant in a single interface. Rejections trigger automated offboarding: disable the account, revoke API keys, remove from groups. Approvals get logged with a timestamp for audit trails. The system generates a summary report showing approval rates, flagged anomalies, and remediation actions—the exact artifact your compliance team needs. The payoff: your quarterly audit goes from a two-week scramble to a two-day validation. You catch orphaned accounts before they become a breach vector. You reduce privilege creep (the slow accumulation of unnecessary access). And you have a repeatable, auditable process that scales as your stack grows.
Trigger: Quarterly calendar event (or manual trigger). System pulls access lists from all connected SaaS apps via API on the first Monday of Q1, Q2, Q3, Q4.
Connect to each SaaS platform (Okta, Azure AD, Salesforce, Slack, GitHub, etc.) via API or automated export. Collect user ID, email, role, last login, group membership, and access level. Store in centralized access inventory database or spreadsheet.
Map user identities across systems (handle email aliases, contractor accounts, service accounts). Remove duplicates. Flag orphaned accounts (no recent login, no manager assignment). Categorize access by sensitivity level (admin, editor, viewer, guest).
Assign each user's access to their direct manager for certification. Highlight high-risk access (admin roles, cross-department access, inactive users with active access). Create review packages grouped by department, application, or risk tier.
Email managers with their assigned access review list. Include user name, role, last login date, and apps accessed. Provide deadline (typically 5–7 business days). Include link to review portal or approval form. Send reminders at day 3 and day 6.
Managers review each user's access and attest 'Approve,' 'Revoke,' or 'Investigate.' Provide comment field for context (e.g., 'User left team, access should be removed'). Track certification timestamp and manager identity for audit trail.
Run behavioral analysis: flag users with access to conflicting roles (e.g., finance + HR sensitive data), access not used in 90+ days, or access granted outside normal onboarding windows. Generate risk scores. Escalate high-risk findings to security team for manual review.
Security lead or identity governance team reviews AI-flagged anomalies and manager challenges. Decide: approve, revoke, or request additional context. Document rationale for each decision for compliance records.
Batch revoke access approved for removal. Disable user accounts in SaaS apps, remove from groups, revoke API tokens. Log each revocation with timestamp, approver, and reason. Send confirmation to user's manager and IT helpdesk.
Compile quarterly access review report: total users reviewed, access revoked, anomalies detected, manager certification rate, time-to-certify metrics. Include executive summary, risk findings, and remediation status. Export in formats required by auditors (PDF, CSV).
Store all certification records, manager attestations, and security decisions in immutable audit log (e.g., Splunk, Datadog, or compliance archive). Update access baseline for next quarter. Close workflow and schedule next review.
1. Inventory your SaaS apps and confirm API access (Okta, Google Workspace, GitHub, Slack, Figma, etc.). 2. Map user identities across systems using email as the primary key. 3. Define manager-to-team relationships in your HRIS or a static config. 4. Build a review form template: user name, app, access level, last login, manager approval/rejection. 5. Connect your workflow tool (Zapier, Make, or custom API) to pull rosters and push review forms to managers via email or Slack. 6. Set up automated offboarding actions: disable accounts, revoke tokens, remove from groups. 7. Route the final compliance report to your security and audit teams. 8. Test with one app and one manager before rolling out to the full stack.