Topic starter
05/07/2026 6:43 pm
TL;DR: Access reviews often become unsustainable after a few cycles, with review backlogs, visibility gaps, and remediation delays causing risk to accumulate faster than governance teams can clear it, according to Zluri. The real issue is not running reviews, but turning them into a repeatable control that actually closes violations.
Editorial analysis by NHI Mgmt Group, based on content published by Zluri: “How to Carry Out a User Access Review (Advanced Guide)”.
By the numbers:
- The first review in the example took 3 weeks, involved 23 people, and revealed 87 apps.
- The article says one review surfaced 600 access violations.
- The article cites 149 person-days per cycle, nearly 3 FTEs, for access reviews.
Key questions
Q: What breaks when user access reviews rely on directory data alone?
A: Directory-only reviews miss apps and access paths that exist outside the identity provider, so the organisation certifies an incomplete estate.
Q: Why do access review backlogs keep growing even when reviews finish on time?
A: Backlogs grow when the decision is made during the review but the revocation is left to manual follow-up.
Q: How can security teams know whether access reviews are producing real control?
A: They should compare review outputs with live HR, IdP, and application state, then check whether drift keeps reappearing between cycles.
Practitioner guidance
- Implement continuous multi-source discovery Connect identity, finance, browser, endpoint, and application data so the review scope reflects what is actually in use, not only what the directory shows.
- Set risk-based review scopes Classify applications by business criticality, regulatory exposure, and privilege level, then review the highest-risk apps more frequently than low-risk apps.
- Automate denial remediation with proof Route access removals through API workflows where possible, capture evidence of completion, and escalate unresolved denials before they roll into the next cycle.
Bottom line: User access reviews break down when scope, approval quality, and revocation workflows do not scale together.
Explore further
View Full Forum → | NHI Foundation Course → | Our Services → | Read the full analysis →
05/07/2026 6:59 pm
Access reviews fail when the estate being certified is smaller than the estate actually in use. The article’s discovery examples show that directory-based scoping can miss a large portion of the live application surface once SaaS sprawl, browser access, and finance signals are all in play. That is not merely incomplete data, it is a governance blind spot that makes certification decisions look valid while leaving real access untouched. Practitioners should treat scope integrity as the first control, not a reporting detail.
A question worth separating out:
Q: Should organisations use group-based reviews or individual reviews for scale?
A: Use group-based review where access is already standardised and the group owner understands the entitlement set, then keep individual review for privileged, external, or directly assigned access. The right balance reduces decision volume without hiding exceptions that still need human judgment.
👉 Read our full editorial: User access reviews at scale expose the governance breakpoints