What are the signs that group access reviews are missing dormant permissions?

A common sign is when review processes rely on static group membership instead of actual application usage. If teams cannot tell which members have never used a permission, they are likely rubber-stamping access decisions. Another warning sign is depending on token refresh data that is too delayed to show recent activity accurately.

Why Dormant Permissions Hide Inside Group Reviews

group access review can look clean on paper while still missing permissions that no one actually uses. That usually happens when reviewers only confirm that a user belongs to the right group, rather than checking whether the group still grants active, needed access in the application itself. Once a review process loses sight of actual usage, dormant rights become invisible and stale access survives another cycle.

This matters because dormant permissions are not harmless clutter; they expand the blast radius of a compromised account, complicate least-privilege decisions, and make attestation outputs less trustworthy. The challenge is especially common in environments where groups are reused across teams, applications, or environments, because inherited access looks legitimate even when individual entitlements are no longer justified. NHI Management Group research shows that only 5.7% of organisations have full visibility into their service accounts, which is a useful reminder that access reviews often fail first at visibility, not policy.

In practice, many security teams discover dormant permissions only after an audit, incident review, or access cleanup reveals that nobody could explain why the access was still there.

How Group Reviews Miss Dormant Rights in Practice

The core failure is a mismatch between the object being reviewed and the thing that actually creates risk. A group review confirms membership, but dormant permission risk lives in the effective access granted by that membership. If a single group feeds multiple applications, inherited roles, or nested entitlements, a reviewer may approve the group without realising that some permissions inside it have become functionally dead. That is especially common when business owners are asked to certify access they do not observe directly in daily operations.

Good reviews connect group membership to evidence of use. That means looking for application logs, last-used timestamps, entitlement activity, and exception handling that explain why access exists. It also means treating delayed telemetry carefully. If token refresh or session data lags behind actual activity, a reviewer may see a recent refresh and assume the permission is active when the underlying entitlement has not been meaningfully used. The review then records presence, not necessity.

A practical review workflow should ask three questions: does the member still need the group, does the group still grant active permissions in the target system, and is there evidence that those permissions are exercised within the expected business window? If the answer to any of those is unclear, the reviewer should not certify by default. NHI lifecycle guidance from NHI Lifecycle Management Guide is useful here because dormant access is often a lifecycle failure, not a one-time access approval error.

Where possible, pair the review with authoritative control guidance such as NIST SP 800-53 Rev 5 Security and Privacy Controls, which reinforces the need for account review, least privilege, and timely removal of unnecessary access. These controls tend to break down when access data is aggregated too coarsely to distinguish real usage from inherited permission inheritance.

Common Patterns That Make Dormant Access Look Active

Tighter review criteria often increase workload, so organisations have to balance speed against confidence. That tradeoff becomes visible in a few recurring patterns. First, shared or nested groups can make one active use case mask several inactive ones. Second, application owners may approve access based on organisational role rather than current task need, which preserves access that no longer has a live business purpose. Third, review tools may surface status signals that look meaningful but are too indirect to prove use, such as a recent authentication event without evidence that the specific permission was exercised.

Another common edge case is access that is intentionally dormant but still justified, such as emergency or break-glass membership. Current guidance suggests treating those cases separately from routine access reviews, because the approval logic is different. If the permission is meant to remain unused unless a specific event occurs, then “no usage” is not a defect; it is the expected state. The reviewer’s job is to verify the exception basis, not force routine activity.

For broader identity and secret-risk context, the Ultimate Guide to NHIs is helpful because the same review blind spot often appears in machine and service identities, where dormant access is harder to notice and easier to retain. Organisations that rely on coarse review evidence usually find the problem only after permissions accumulate faster than anyone can rationally certify them.

Risk and Threat Considerations

Dormant permissions are a privilege accumulation risk. Even when no active misuse is visible, unused access still enlarges the attack surface, makes account compromise more valuable, and weakens confidence in attestations that are supposed to reduce exposure.

Failure mechanism: Reviewers certify membership without validating effective usage, inherited entitlements, or stale role carryover. That allows old permissions to remain in place indefinitely, especially in grouped or nested access models where the actual entitlement path is obscured.

Impact: A compromised account can inherit more privilege than business need justifies, cleanup becomes harder, and the organisation may believe access is controlled when the dormant rights are still live.

Standards & Framework Alignment

This section maps relevant standards and security frameworks to the operational risks and controls described in this guidance.

MITRE ATT&CK address the attack and risk surface, while CIS Controls v8 and NIST CSF 2.0 set the governance and control requirements practitioners need to meet.

Framework	Control / Reference	Relevance
CIS Controls v8	6 — Access Control Management	Group reviews are access control checks aimed at removing unnecessary permissions.
Recommendation — Review group entitlements regularly and remove access that is no longer needed.
NIST CSF 2.0	PR.AC-4 — Access Permissions and Authorizations Managed	Dormant permissions signal weak authorization management in access reviews.
	DE.CM-8 — Monitoring for Unauthorized Devices, Users, and Software	Usage evidence helps distinguish active entitlements from dormant access.
	PR.DS-1 — Data-at-Rest Protected	Excess permissions can expose data even when access appears dormant.
Recommendation — Validate that permissions remain necessary and revoke stale authorizations promptly. Correlate review decisions with usage telemetry before certifying access. Limit dormant rights that could still expose sensitive data if abused.
MITRE ATT&CK	T1078 — Valid Accounts	Stale group permissions expand the usefulness of compromised accounts.
Recommendation — Hunt for valid-account abuse paths created by over-permissive group membership.

Practitioner Guidance

What to verify: Require evidence that the permission was actually exercised during the review period, not just that the user or service account remained in the group. If the only proof is membership or a stale refresh event, treat the access as unverified rather than approved.

Decision rule: If a group grants access to more than one application or environment, review the effective entitlements separately from the group record. If the review cannot distinguish active from dormant rights, the control should be considered incomplete.

What practitioners underestimate: Dormant permissions are often a reporting problem before they become a security problem. The real test is whether the review process can name why each permission still exists; if it cannot, the organisation is certifying historical structure instead of current need.

Practitioner takeaway: The strongest access reviews prove necessity at the entitlement level, not just membership at the group level.