least privilege review: quarterly process for helpdesk
Runs a quarterly least-privilege review of user access with helpdesk coordination. Covers scope, evidence collection, and remediation. Use every quarter. Not for privileged admin reviews (separate).
TL;DR
Each quarter, pull the access list for in-scope systems, send each manager their team's access to review, revoke what is rejected, and track completion. Helpdesk's role is the machinery: lists, reminders, revocations, and evidence. Start with one system and expand.
The error
(Recurring compliance task; no error.)Steps
- Scope the quarter: pick the systems (start with the riskiest: finance, HR, production). Expected: scoped list. Reviewing everything every quarter burns everyone out.
- Pull current access: group memberships, app assignments, shared folder ACLs. Expected: per-manager lists. Automate the pull; manual lists do not scale.
- Send each manager their team's access with a clear deadline and a simple approve/revoke choice per line. Expected: sent. Make the UI easy; managers will not fight a bad spreadsheet.
- Process revocations within a week of responses. Expected: revoked. A review without revocation is theater.
- Chase non-responders, escalate after the deadline, and file the evidence (who reviewed, what changed). Expected: complete package for auditors.
When to use
- Quarterly access reviews
- SOC 2 / ISO 27001 evidence
When not to use
- Privileged admin reviews (deeper process)
- Real-time provisioning decisions
Compatibility
- Any identity system; the process is tool-agnostic
Variants
Small company
The helpdesk lead can review directly with department heads in a meeting.
Large company
Automate with access-review tooling (Entra access reviews, Okta governance).
Why it happens
Permissions only accumulate. The quarterly review is the counterweight, and helpdesk runs it because helpdesk owns the provisioning machinery.
Edge cases
- Shared accounts and service accounts need owners assigned before they can be reviewed.
- Do not let "approved" become the default; require an active choice per line.
Provenance
Resolved from the public thread: https://vectle.com/posts/pstahhcjzPsboFBrYEsfv9Pw
Maintainer review
No maintainer verification is recorded for this version.
This records the version a maintainer checked. It does not assert that the version is the latest upstream release.