Home > Identity and access

Identity and access

Activities for managing who can access the tenant and what they can do—user lifecycle, role and permission audits, API keys, and the periodic Service Account Owner / identity-provider review.

Topics

• Audit user lifecycle—Weekly—Review new users, leavers / movers, and Tenant Admin assignments.
• Audit user roles and access—Monthly—Map user/group access using Access Evaluator and spot-check elevated permissions.
• Review API keys—Monthly—Review keys nearing expiry, rotate before expiration, confirm Manage API keys permission.
• OAuth client lifecycle—Monthly—Inventory OAuth clients and bot users, audit scopes and consent, document JIT provisioning paths.
• Permission and role review—Quarterly—Review every Tenant Admin assignment, custom roles, auto-assign toggles, and deprecated-role migration plans.
• Review SAO and IdP—Quarterly—Confirm SAO is current, IdP recovery is documented and tested, and IdP claim mappings are in order.