[Home](https://help.qlik.com/en-US/cloud-admin-playbook/Content/home.htm) > [Identity and access](https://help.qlik.com/en-US/cloud-admin-playbook/Content/identity_and_access.htm) > Audit user roles and access

# Audit user roles and access

**Cadence:** Monthly

**Subscription model:** All

**Roles:** Tenant Admin (TA)

**Last verified:** 2026-05

|  | Initial | Recurring |
| --- | --- | --- |
| **Estimated time** | 1 hr | 30 min |

**Benefits:**

* Detects users with elevated privileges that no longer match their role
* Surfaces unexpected auto-assigned roles to
  > Anyone at <tenant>
* Aligns role drift with the principle of least privilege

***

## Goal

A monthly access audit complements the weekly user-lifecycle review. The Access Evaluator monitoring app maps users and groups to spaces, apps, and roles for tenant-wide visibility. Spot-check anyone holding elevated permissions (Tenant Admin, custom admin-equivalent roles, Manage API keys) to confirm continued business need.

## Tasks

| Task | TA | AA | DA | AuA |
| --- | --- | --- | --- | --- |
| Use the **Access Evaluator** monitoring app to map user / group access to spaces, apps, and roles (community-supported) | ✓ |  |  |  |
| Spot-check users with elevated permissions (Tenant Admin, custom admin-equivalent roles, Manage API keys) | ✓ |  |  |  |
| Review groups under Manage users in the admin console, especially any auto-assigned roles to<br><br>> Anyone at &lt;tenant&gt; | ✓ |  |  |  |

## Automation helpers

* **Qlik Cloud Monitoring Apps Deployer**—Installs / maintains the Access Evaluator cited above.

## References

* [Auditing user roles and access](https://help.qlik.com/en-US/cloud-services/Subsystems/Hub/Content/Sense_Hub/Admin/permissions-auditing.htm)
* [Permissions granted by security roles (user-based)](https://help.qlik.com/en-US/cloud-services/Subsystems/Hub/Content/Sense_Hub/Admin/SaaS-user-permissions.htm)
* [Permissions granted by security roles (capacity-based)](https://help.qlik.com/en-US/cloud-services/Subsystems/Hub/Content/Sense_Hub/Admin/SaaS-user-permissions-capacity-model.htm)
* [Access Evaluator (Tooling appendix)](https://help.qlik.com/en-US/cloud-admin-playbook/Content/tooling/access_evaluator.htm)

**Tags:** `#monthly` `#identity_and_access` `#access` `#roles` `#access_evaluator`