Home > Identity and access > Audit user roles and access
Audit user roles and access
Last updated: 11/3/2026Cadence: Monthly
Subscription model: All
Roles: Tenant Admin (TA)
Last verified: 2026-05
| Initial | Recurring | |
|---|---|---|
| Estimated time | 1 hr | 30 min |
Benefits:
- Detects users with elevated privileges that no longer match their role
- Surfaces unexpected auto-assigned roles to
Anyone at <tenant>
- Aligns role drift with the principle of least privilege
Goal
A monthly access audit complements the weekly user-lifecycle review. The Access Evaluator monitoring app maps users and groups to spaces, apps, and roles for tenant-wide visibility. Spot-check anyone holding elevated permissions (Tenant Admin, custom admin-equivalent roles, Manage API keys) to confirm continued business need.
Tasks
| Task | TA | AA | DA | AuA |
|---|---|---|---|---|
| Use the Access Evaluator monitoring app to map user / group access to spaces, apps, and roles (community-supported) | ✓ | |||
| Spot-check users with elevated permissions (Tenant Admin, custom admin-equivalent roles, Manage API keys) | ✓ | |||
Review groups under Manage users in the admin console, especially any auto-assigned roles to Anyone at <tenant> |
✓ |
Automation helpers
- Qlik Cloud Monitoring Apps Deployer—Installs / maintains the Access Evaluator cited above.
References
- Auditing user roles and access
- Permissions granted by security roles (user-based)
- Permissions granted by security roles (capacity-based)
- Access Evaluator (Tooling appendix)
Tags: #monthly #identity_and_access #access #roles #access_evaluator