Topic starter
06/07/2026 9:46 am
TL;DR: Most organisations struggle with access reviews because they cannot see all apps, decide what to scope first, or assign reviewers cleanly, according to Zluri. The real problem is not understanding why reviews matter, but building a review process that is complete enough to survive audit and remediation.
Editorial analysis by NHI Mgmt Group, based on content published by Zluri: “User Access Review Process: 5 Key Steps”.
By the numbers:
- Manual discovery is expected to cover 40-60% of actual apps, according to the article.
- Basic automation is expected to cover 50-75% of actual apps, according to the article.
- Comprehensive automation is said to reach 99%+ of actual apps, according to the article.
Key questions
Q: What breaks when organisations launch access reviews without full visibility?
A: They certify only the access they can see, which usually means the review excludes shadow IT, embedded apps, and non-SSO tools.
Q: Why do access reviews become unmanageable when teams try to review everything at once?
A: Because scope and volume overwhelm reviewers before they can make meaningful decisions.
Q: What are the signs that an access review process is failing in practice?
A: A failing access review process usually shows up as long approval cycles, overloaded reviewers, repeated manual preparation, and heavy engineering effort just to launch each campaign.
Practitioner guidance
- Build discovery before certification Pull app data from your IDP, finance systems, and department sources so the first review covers the real application estate rather than only what one system can see.
- Scope the first review to high-risk apps Start with financial, customer, privileged, contractor, and compliance-sensitive systems, then expand coverage after the process is proven.
- Choose the right review unit Use group-based review where access is granted through SSO groups, and reserve user-level certification for individually assigned or privileged access.
Bottom line: The central problem is not deciding whether access reviews matter, but building the launch sequence so the first review covers real applications, real owners, and real remediation paths.
Explore further
View Full Forum → | NHI Foundation Course → | Our Services → | Read the full analysis →
06/07/2026 10:02 am
Access reviews fail first at discovery, not at approval. The article shows that organisations often start certification before they have a trustworthy view of applications, users, and group-based entitlements. That is a governance failure because the review is only as complete as the inventory behind it. In IAM terms, the control is being asked to certify an estate it does not fully know, which turns review into partial assurance. The practitioner conclusion is simple: treat discovery as the prerequisite control, not a preparatory task.
A question worth separating out:
Q: Should organisations use group-based or user-based access reviews?
A: Use group-based reviews when access is commonly granted through SSO groups, because the review boundary matches how access is actually administered. Use user-based reviews for individually assigned access and privileged accounts. The right choice is the one that reflects the operating model, not the one that feels simpler on paper.
👉 Read our full editorial: Launching your first access review without losing control