Quarterly user access review checklist
Access only ever grows. People change roles and keep their old permissions, guests from finished projects linger, and an admin account created for a one-off job is still there two years later. A quarterly access review is how you pull it back.
Reviewed by the ITRS security team · Last updated
Why access drifts
Access is granted quickly because someone is waiting to work. It is rarely removed, because nothing breaks when it stays. Over time that creates accounts with far more reach than their owner needs, which is exactly what an attacker wants when they compromise one.
Frameworks expect this to be managed. ISO/IEC 27001:2022's Annex A includes controls on access rights and privileged access rights that call for access to be reviewed at regular intervals. The Canadian Centre for Cyber Security's baseline controls for small and medium organizations list access control and authorization based on least privilege. Cyber insurers increasingly ask about it too.
What to review
Work from exported lists, not memory. In Microsoft 365, export users, group memberships, role assignments and guests from Microsoft Entra ID; in Google Workspace, export users, admin roles and group memberships from the Admin console.
| Area | Question | Evidence |
|---|---|---|
Active user accounts | Does each match a current employee or contractor? | User export vs HR active list |
Disabled or unlicensed accounts | Should it be deleted, preserved or kept? | Last sign-in date, hold status |
Group and team membership | Does each member still need it? | Group export per owner |
Sensitive sites and shared mailboxes | Who can open HR, finance, leadership and client data? | Site permissions and mailbox delegates |
Line-of-business apps | Accounting, practice management, CRM, banking | User lists exported from each app |
Admin and privileged roles | Who holds them and why? | Role assignment export |
Guests and external users | Is the project or relationship still active? | Guest list with last sign-in |
Service and shared accounts | Who owns each? Is it still used? | Sign-in logs, owner list |
Admins and privileged roles
- Keep Global Administrator (or Workspace super admin) to a small number of named people plus documented emergency accounts.
- Admin roles should sit on separate admin accounts, not on everyday mailboxes.
- Use narrower roles (User Administrator, Exchange Administrator, Billing) instead of Global Admin wherever possible.
- Check that every admin has phishing-resistant MFA or at least MFA enforced by policy.
- Where licensed, Privileged Identity Management can make admin roles eligible rather than permanent, so they are activated for a time-limited period with a reason.
- Look for admin roles granted to vendors or former MSPs. Remove anything not covered by a current contract.
Guests and external users
Guests are the fastest-growing part of most directories. Sort guests by last sign-in and by the team or site that invited them. Remove anyone without a current reason, and ask owners of client collaboration sites to confirm their list.
With the right licences, Microsoft Entra Access Reviews can automate this: owners or the guests themselves are asked to confirm access, and denied or unanswered reviews can remove access automatically. Without those licences, the same review works with exports and a spreadsheet.
Service and shared accounts
- Every service account has a named owner and a short description of what uses it.
- Interactive sign-in is blocked where the platform allows.
- Shared mailbox access is granted through groups, not individual delegations that are forgotten.
- Accounts used by former vendors, old scanners or retired software are disabled, then removed after a waiting period.
- Passwords for any shared credential are rotated if someone with access has left.
Recording the review
The record is what makes a review count. Auditors, insurers and, after an incident, regulators and counsel will ask to see it.
Export and date the lists
Save the exports used, with the date pulled.
Send each owner their slice
Managers confirm their team; site owners confirm their site; IT confirms admins.
Record decisions
Keep, remove or change, with the reviewer's name and date.
Make the changes
Then re-export to confirm they took effect.
Sign off
A short summary: what was reviewed, what changed, exceptions accepted and by whom.
Set the next date
Quarterly for admins, guests and sensitive data; at least twice a year for everything else.
Questions we hear
For a firm of 20 to 50 people, the first one takes the most effort. Later reviews are mostly confirming small changes, especially if access is granted through groups.
Managers and data owners confirm access; IT prepares the lists and makes the changes. IT alone cannot judge whether a person still needs a client site.
Related reading.
- PracticeManaged IT SupportHelpdesk and break/fix, networking, security systems, devices, Microsoft 365, cloud and backup.
- GuideProtecting admin accounts in Microsoft 365An attacker who gets a Global Administrator session owns the tenant: every mailbox, every file, every setting, and the audit trail.
- GuideLocking down SharePoint and OneDrive external sharingOut of the box, Microsoft 365 lets staff share files with almost anyone. That is convenient until a confidential folder link turns up in the wrong inbox.
- GuideWhat to do if a former employee still has accessYou've found that someone who left can still sign in somewhere: email, a SaaS app, the VPN, a shared password. Cut the access, then find out whether it was used.
- GuideEmployee offboarding security checklistMost access problems after someone leaves come from process gaps, not technology: nobody told IT, a shared password wasn't changed, or a laptop came back weeks late.
Want this handled for your business?
Tell us your users, devices and sites. We are staffed 24/7 and reply with next steps. Quotes are built from your environment, not a price list. Active incident? Call (289) 582-9930, 24/7.