What should organisations do when AD access is still tied to tickets and spreadsheets?

Why tickets and spreadsheets stop being enough for AD lifecycle control

Tickets and spreadsheets are fine as intake and tracking aids, but they do not create a reliable control plane for access. The problem is not only operational delay, it is loss of authoritative state: who should have access, who still has it, and whether removal actually happened. When that state lives outside the governed identity record, joiner, mover, and leaver actions become hard to enforce consistently.

The practical shift is to treat the ticket as a request, not as the system of record. Provisioning, modification, and deprovisioning should be driven from an authoritative workflow that can update access centrally, preserve approvals, and support auditability across the full lifecycle. That makes the identity record the source of truth rather than a collection of disconnected artefacts.

What changes when the identity record becomes the control plane?

Once the identity record is authoritative, access decisions become lifecycle events instead of one-off manual tasks. A mover event can trigger entitlement changes, a leaver event can trigger revocation, and approvals can be tied to the same governed record that reflects the current access state. This reduces the common gap where a ticket closes but the underlying account or entitlement remains active.

The key design point is separation of concerns. Requests may still arrive through service management, but the enforcement point should be identity governance, directory workflow, or PAM-adjacent controls that can execute and verify the change. That is what turns a process into a control.

For organisations that need a prescriptive control model, CIS Controls v8 is useful for framing account management and access control as operational safeguards, while NIST SP 800-53 Rev 5 Security and Privacy Controls aligns well where identity lifecycle, access enforcement, and audit evidence all need to be demonstrable. In mature identity programs, this is also where ISO/IEC 27001:2022 Information Security Management helps anchor the need for repeatable access governance rather than ad hoc administration.

What good looks like in practice

Good practice is not “fewer tickets”, it is a shorter and more reliable path from request to verified state change. A strong model has one governed identity record, automated provisioning and deprovisioning where possible, explicit approval history, and evidence that removals were completed rather than merely requested. The access state should be reconstructible without chasing email threads or spreadsheet versions.

For organisations modernising the workflow, the useful question is whether the process can prove three things: the request was authorised, the change was executed against the real system, and the resulting access state matches policy. If any of those are missing, the ticket is only recording intent. For workflow design and control validation, NCSC UK Advice and Guidance is a helpful reference point for operational discipline, and NIST Cybersecurity Framework 2.0 provides a broader governance lens for establishing, operating, and checking the control.

Risk and Threat Considerations

When AD access is still managed through tickets and spreadsheets, the main risk is stale or unverified access. That creates a control gap where leavers may retain accounts, movers may keep old entitlements, and privileged access may persist long after the business need has ended. In a compromise scenario, the same gap makes it harder to see whether access was intentionally granted or simply never removed.

Failure mechanism: Manual handoffs and disconnected records let provisioning and deprovisioning drift apart, so the directory can remain out of sync with the approved access decision.

Impact: Orphaned access, privilege accumulation, delayed revocation, and weaker audit evidence, all of which increase the blast radius of both insider misuse and account compromise.

For threat modelling, this is closely related to privilege persistence and lateral movement risk. The longer access survives beyond the business need, the more opportunity exists for abuse, especially where service accounts, admin groups, or shared credentials are involved. MITRE ATT&CK Enterprise Matrix is a useful lens for thinking about how stale access supports credential access, privilege escalation, and downstream movement.

Practitioner Guidance

What to prioritise: Move first on leaver and privilege-change events, because those have the highest exposure if they fail. If the workflow can only be improved in one area initially, start where revocation and elevated access are most time-sensitive.

What to verify: Confirm that every access change has a source request, an approver, an execution record, and post-change state verification. If you cannot show the before-and-after account state from the authoritative record, the control is not yet trustworthy.

Common mistake: Preserving spreadsheet ownership because it feels easier than changing the directory or governance workflow. The spreadsheet may remain useful for exception tracking, but it should never be the place where access truth lives.

Practitioner takeaway: The goal is not to eliminate tickets, it is to ensure that human request handling sits above a governed identity workflow that can actually enforce, verify, and evidence the change.

Related resources from NHI Mgmt Group

• How should organisations govern access when IAM is spread across spreadsheets and tickets?
• How should security teams run access reviews for non-human identities?
• How should security teams govern non-human identities that have persistent access?
• When do NHI access reviews create more value than a one-time cleanup?