IntegrAuth Academy
Identity, security and practical AI — free, from zero. Byte-sized lessons, real diagrams, hands-on labs, zero fluff. Two programs, each with its own exam and certificate.
English is hard? Your browser can translate this page into Tamil, Telugu, Kannada, Malayalam or Hindi. Tech words stay in English so you learn the real names.
How?
- Chrome on phone: ⋮ menu → Translate
- Chrome on computer: right-click → Translate to …
- Edge: the translate icon in the address bar
Access reviews & least privilege
Priya has worked at the company for three years. Every project gave her new access. Nobody took any back. Your goal: explain why access piles up and how an access review trims it.
- Access piles up when nobody removes it. This is entitlement creep.
- Every unused grant adds to the damage of a break-in.
- A good review shows usage data and ranks rows by risk.
- Let unused grants expire unless someone keeps them.
Priya collects access
Access is easy to give and hard to take away. So it piles up. Priya joins Support with 2 grants. She moves to Ops and gets 3 more. She keeps the Support ones "just in case". A finance project gives her Finance admin. Nobody removes it when the project ends. This is entitlement creep: access that stays after the reason for it is gone. It is the weak end of the Joiner–Mover–Leaver lifecycle.
How big is the damage?
Every unused grant is stored risk. Imagine someone phishes Priya's account. The attacker gets everything she has collected. That includes Finance admin and an old Payroll export. It is not only the things she uses this week. Least privilege keeps the blast radius (the damage one break-in can reach) to what the job needs today. Creep makes it bigger every month.
A key ring that grows with every flat you ever rented. You still carry all the keys. If the ring is stolen, every old door opens. Only keys you use today belong on it.
Priya holds eight entitlements and uses three. The other five are pure blast radius. One is a Finance admin grant last used 412 days ago. Nobody knows it is still there, until the review finds it.
The review campaign
The answer is a regular access review. It is also called an access certification campaign. An accountable person looks at each grant and says "keep" or "revoke". A strong campaign has three parts. The reviewer is the resource owner or the person's manager, who know the job. Not central IT. Reviews are small, frequent and ranked by risk, not one big yearly campaign. Every row shows usage data, such as "last used 340 days ago".
Beat the rubber stamp
Give a manager 200 rows, and they approve all 200. This is the rubber-stamp problem. It makes risk look like care. Make the safe answer the easy answer.
📊 Show usage
Put "last used" next to every grant. 340 days ago makes revoking easy.
🎯 Rank by risk
Show dangerous rows first: unused admin, standing privileged access, orphaned accounts.
🧹 Revoke by default
Let unused grants expire unless someone gives a reason to keep them. Silence should remove access.
Least privilege is never finished. A birthright role is the access that everyone in a job gets automatically. It keeps the base small. Anything extra should be requested, limited in time and reviewed. Revoking a grant that is in use breaks someone's day. So decide with usage data.
Provisioning (SCIM) keeps joining and leaving clean. Reviews keep the middle honest. See also access-control models.
Go deeper: Finding the base role
You can find a birthright role with role mining. Look for the access that people in the same job already share.
🧪 Interactive lab — enable JavaScript to play with this one.
Reviewing what an app can really reach? Rank a third-party OAuth app's requested scopes by risk with Consent Check, or talk to our team about access-review automation.