ABCDEFGHIJKLMNOPQRSTUVWXYZ
1
User access review template (2026)
2
Companion to the Synk.to guide: https://synk.to/blog/user-access-review-checklist
3
4
How to run a review cycle
5
1. Make a copy of this file for each review cycle and name it after the period, for example "UAR 2026-Q4".
6
2. Scope tab: list every system in scope with its owner, reviewer and review frequency. Include apps that don't use single sign-on.
7
3. Access review tab: paste one row per account from each system's export. Add service accounts, shared accounts and API tokens too. Delete the three example rows first.
8
4. Fill in each account's HR status from your HR system and its last sign-in date from the export. Days inactive calculates itself.
9
5. Flag every account: Ex-employee, Orphaned, Inactive, Privileged, Shared or service, or OK.
10
6. Reviewers choose Keep, Change or Remove for every row and write the reason. "Keep" needs a reason too. Nobody reviews their own access.
11
7. Open a ticket for each Change or Remove and record it. After the fix, export the system again to verify, and fill in Date fixed and Verified by.
12
8. Privileged accounts tab: review every admin role separately, at least quarterly.
13
9. OAuth apps tab: review the third-party apps connected to Google Workspace or Microsoft Entra ID, with their scopes.
14
10. Sign-off tab: the counts calculate from the Access review tab. The reviewer and the approver sign for each system.
15
16
Decisions
17
Keep: the access is still needed. Write down why.
18
Change: reduce the role, remove admin rights or remove part of the access.
19
Remove: delete, deactivate or suspend the account.
20
21
Flags
22
Ex-employee: HR says the person left, but the account is still active.
23
Orphaned: no matching person in the HR list.
24
Inactive: no sign-in for longer than your threshold, for example 90 days.
25
Privileged: admin, owner or super admin role.
26
Shared or service: not tied to one person. It needs a named owner and a reason to exist.
27
OK: matched to a current person, active, and the access fits the job.
28
29
How often to review
30
PCI DSS v4, Requirement 7.2.4: all user accounts and access privileges, at least once every six months (mandatory since March 31, 2025).
31
CIS Controls v8.1: confirm that all active accounts are authorized at least quarterly (Safeguard 5.1); review privileges at least annually (Safeguard 6.8).
32
SOC 2, ISO 27001 and SOX: you set the frequency in your policy. Quarterly for privileged accounts and in-scope systems, and every six months for the rest, is a common default.
33
34
Evidence to keep for each cycle
35
The account exports you reviewed, with who ran them, when and with which filters; a decision and reason for every account; the tickets; the exports after the changes; and this file's Sign-off tab.
36
37
Adapt the columns to what your auditor asks for.
38
39
40
41
42
43
44
45
46
47
48
49
50
51
52
53
54
55
56
57
58
59
60
61
62
63
64
65
66
67
68
69
70
71
72
73
74
75
76
77
78
79
80
81
82
83
84
85
86
87
88
89
90
91
92
93
94
95
96
97
98
99
100