[Home](https://help.qlik.com/en-US/cloud-admin-playbook/Content/home.htm) > Identity and access

# Identity and access

Activities for managing who can access the tenant and what they can do—user lifecycle, role and permission audits, API keys, and the periodic Service Account Owner / identity-provider review.

## Topics

* [Audit user lifecycle](https://help.qlik.com/en-US/cloud-admin-playbook/Content/identity_and_access/audit_user_lifecycle.htm)—*Weekly*—Review new users, leavers / movers, and Tenant Admin assignments.
* [Audit user roles and access](https://help.qlik.com/en-US/cloud-admin-playbook/Content/identity_and_access/audit_user_roles_and_access.htm)—*Monthly*—Map user/group access using Access Evaluator and spot-check elevated permissions.
* [Review API keys](https://help.qlik.com/en-US/cloud-admin-playbook/Content/identity_and_access/review_api_keys.htm)—*Monthly*—Review keys nearing expiry, rotate before expiration, confirm Manage API keys permission.
* [OAuth client lifecycle](https://help.qlik.com/en-US/cloud-admin-playbook/Content/identity_and_access/oauth_client_lifecycle.htm)—*Monthly*—Inventory OAuth clients and bot users, audit scopes and consent, document JIT provisioning paths.
* [Permission and role review](https://help.qlik.com/en-US/cloud-admin-playbook/Content/identity_and_access/permission_and_role_review.htm)—*Quarterly*—Review every Tenant Admin assignment, custom roles, auto-assign toggles, and deprecated-role migration plans.
* [Review SAO and IdP](https://help.qlik.com/en-US/cloud-admin-playbook/Content/identity_and_access/review_sao_and_idp.htm)—*Quarterly*—Confirm SAO is current, IdP recovery is documented and tested, and IdP claim mappings are in order.