Lesson 17 of 21
Start an access review and decide the grants
What you will be able to do
This lesson is for access administrators and reviewers. An access review is a regular check in which a reviewer confirms or removes every role grant in one part of the organisation. You will start a review of the UAE Operations region, keep the grants that are still needed, revoke one that is not, and close the review so that it stands as a record.
Before you start
- The grants from the earlier lessons exist, so the review has something to check.
- You hold a role that may run access reviews, such as Security administrator.
Steps
- 1
Open Access control on the Access reviews tab
In Access control select the Access reviews tab. A review, also called a recertification, lists every role grant in a chosen part of the organisation so that a reviewer can keep or revoke each one. A role grant is one role given to one person or group in one place. No review has been run yet.
- 2
Select Start a review and name it
Select Start a review. The name is suggested from the quarter and the year. Replace it with one that says what is being reviewed.
- Select Start a review
- Type Name *:
UAE Operations quarterly review
- 3
Choose the scope
Under Scope, choose UAE Operations. The review will cover that unit, the units beneath it and the entities placed in them. Choose Whole organisation only when you mean to review every grant.
- Select Whole organisation
- Type Search units and entities…:
UAE - Choose UAE OperationsUAE-OPS · Region
- 4
Check the reviewer and the due date
Reviewer is the person who makes the decisions. It starts as you, and you can choose someone else. Due is set two weeks ahead and can be changed; it must be in the future.
- 5
Read what the automatic revocation does
Switch on Revoke anything left unreviewed after the due date to read its warning: after the due date the review closes by itself and every undecided grant is revoked. Use it only when your policy demands it. Switch it off again for this review.
- Select review-auto-revoke
- Select review-auto-revoke
- 6
Select Start review
Select Start review. A message says how many grants there are to check, and the review opens. The header shows the scope, the reviewer, the due date and a progress bar.
- Select Start review
- 7
Read the list of grants
Each row is one grant inside the scope: who holds it, the role, where it applies and how it was given. Groups are listed as well as people. Every row has a comment box and the buttons Keep and Revoke.
- 8
Keep a grant with a comment
Find the row for Hana Qasim, the Org unit administrator for this region. Type a short comment in the box on her row and select Keep. The row leaves the list, because Only undecided is switched on, and the progress count goes up.
- Type Comment for Hana Qasim:
Still regional operations manager - Select Keep
- Type Comment for Hana Qasim:
- 9
Filter the list and select Revoke
Type Tariq in the filter box to find one grant among many. Tariq Haddad was invited as a read-only viewer, but the contract did not go ahead. Select Revoke on his row.
- Type Filter by person, role or scope…:
Tariq - Select Revoke
- Type Filter by person, role or scope…:
- 10
Give the reason and select Revoke now
The confirmation says he loses the role immediately and that this is recorded in the review and in the audit log. Type the reason and select Revoke now. The message Access revoked appears.
- Type Comment:
Contract did not go ahead; access no longer needed - Select Revoke now
- Type Comment:
- 11
Keep the remaining grants together
Clear the filter and read the three grants that are left. When they are all still needed, tick the box in the table header to select every row shown, then select the button Keep 3 selected.
- Select Select all shown
- Select Keep 3 selected
- 12
Select Close review and confirm
The list reads Everything here has been decided, and the header shows 5 of 5. Select Close review. The window confirms that every grant has been decided; select Close review again. Closing records the review as complete.
- Select Close review
- Select Close review
- 13
Go back to All reviews and switch on Show closed reviews
Select All reviews at the top left, then switch on Show closed reviews. Closed reviews are kept as a permanent record, each with the date it was closed and its totals. This one shows Keep 4, Revoke 1 and Pending 0. This is the evidence an auditor will ask for.
- Select All reviews
How to check it worked
With Show closed reviews switched on, the review is listed as Closed with 5 of 5 decided and the totals Keep 4, Revoke 1, Pending 0.
Common mistakes
- Selecting everything and keeping it without reading. A review only has value if each grant is looked at; use the comment box to say why an unusual grant stays.
- Switching on the automatic revocation without warning people. After the due date the review closes by itself and every undecided grant is revoked, so people may lose access they still need.
- Forgetting to close the review. Until it is closed it is not a finished record, and it cannot be closed while any grant is undecided.
Check your understanding
1. Which grants become items in a review of the unit UAE Operations?
- A.Every grant in the organisation
- B.The active grants made on that unit, on the units beneath it and on the entities placed in them
- C.Only grants made this quarter
- D.Only privileged roles
Show answer
Answer: B. The active grants made on that unit, on the units beneath it and on the entities placed in them
The scope is the unit with everything beneath it. To include grants made for the whole organisation, such as the administrators', choose Whole organisation as the scope.
2. You select Revoke now on a grant during a review. When does the person lose the access?
- A.When the review is closed
- B.Immediately
- C.On the due date
- D.After a second reviewer agrees
Show answer
Answer: B. Immediately
Revocations in a review take effect immediately and are recorded in the review and the audit log.