Home · Solutions · IT & services
Solution · IT & servicesAccess granted in hours, reviewed every quarter, and withdrawn when it is no longer used
Access requests and quarterly access reviews
Access is requested from a catalogue, approved by the owner who carries the risk, granted by robots in every system including SAP and legacy, and expires unless someone confirms it.
Executive summary
Managers sign off on entitlements they cannot read, and nobody withdraws what nobody uses.
The problem has two halves needing different tools.
People start working on the day they are given the job, because an approved request is provisioned everywhere, not only in the connected systems.
Microsoft Entra ID and Microsoft Entra ID Governance; SAP; the policy and claims applications
Business problem
Identity & access
Access is requested in sentences, not identifiers. "I am taking over the motor portfolio, give me what Anna has." An administrator opens Anna's account, reads her group memberships and SAP roles, and copies what looks relevant. Nobody records why, and nobody sets an end date. Repeat that a few hundred times a month for years, and every long-serving employee carries the union of every job they have held.
The approval step approves nothing meaningful. A manager receives a request naming a security group and an application code, neither of which means anything outside IT. They cannot tell whether it grants sight of a claims file or the right to change a payment instruction, so they approve it.
The quarterly review has the same defect at scale, and it produces a signed record that access was checked. That is worse than no record, because it turns an unexamined entitlement into a confirmed one. The applications the directory never reached sit outside the exercise entirely.
Those who feel this are not those who pay for it. Employees wait days to start work, administrators spend the week on grants instead of projects, and internal audit reconstructs the story each year out of mailboxes.
How it works today
An administrator picks up the ticket and decides alone which entitlements those business words mean, in most companies with more than a handful of applications.
- PersonA ticket describes the access in business words by naming a colleague, and an administrator copies whatever looks relevant from that account
- WaitingRequests touching another department's systems wait for an email approval, typically several days
- SystemThe administrator grants in the directory, then repeats the work in SAP and three other applications
- Risk of errorNothing records the business reason and nothing sets an end date, so access ends when the employee leaves
- PersonOnce a quarter an administrator exports user lists and mails a workbook to each manager
- WaitingReviews come back late, half filled or confirmed in full, and chasing them takes the rest of the quarter
- Risk of errorMovers and leavers keep entitlements wherever the directory does not reach, until an audit finds them
Why the current process costs more than it appears
The most expensive part of this process has no cost line.
- Cloning a colleague's access is fast and structurally wrong. It copies rights accumulated over years, including the ones that person should no longer have, into an account that will itself be cloned.
- Reviews confirmed in full are more dangerous than reviews never run: they evidence that a control operated, while leaving dormant access in place with a signature beside it.
- Waiting costs what IT never sees. A claims handler who cannot open the policy system on Monday is paid to wait until Wednesday.
- Only two administrators know which group grants what. When they are away, requests either stall or are granted generously, and generosity is not reversible without a review nobody trusts.
Cost of inaction
The review figure is arithmetic, not an estimate: 60 applications, four cycles a year, roughly two and a half hours each to export, distribute, chase and consolidate, is 600 hours a year, about €21,600 at the same €36. With the request pool, leaving the process alone costs a modelled €186,000 a year before any risk is priced.
What grows quietly is the entitlement estate itself. Every month adds rights nobody set an end date on, in systems whose user lists nobody reads, confirmed each quarter by managers who cannot see what they confirm. The exposure is not one dramatic event. It is the accumulation of accounts that would give a stolen password more reach than it should have.
A plausible organisation with realistic proportions. The figures are there to be recalculated on your data; they are not a client result.
A European insurance company, 2,200 employees and 60 business applications, on Microsoft 365 E3 with Microsoft Entra ID P1, SAP for finance and HR, plus a policy administration system and a claims platform. Central IT is eleven people, and half the estate is reachable from the directory.
About 1,900 access requests a month across new starters, internal moves, project work and temporary cover. The quarterly review covers 14,000 entitlements spread over 240 line managers and 38 application owners.
Requests arrive as free-text tickets and are fulfilled by hand, by copying a reference colleague. Approvals travel by email, and the review is an Excel export per manager, archived on SharePoint as audit evidence.
Around twelve minutes of administrator handling per request, and a review cycle that consumes weeks of IT time to produce a result nobody acts on. No entitlement carries an owner, a reason or an expiry date.
Requests are made against an access package catalogue in Microsoft Entra ID Governance, approved by the named owner and granted with an expiry date; robots grant in SAP and the on-premises applications and read the accounts back. Each quarter they collect the real user lists and build one review pack per manager.
Catalogue requests work the same day rather than after two to six, administrator handling falls to approval clicks, and every entitlement carries an owner, a reason and a date. The figures are a model, not a measurement from a client.
Proposed solution
The problem has two halves needing different tools. The request half is a governed catalogue: what can be asked for, by whom, who approves it, how long it lasts. Microsoft Entra ID Governance provides this natively through entitlement management. An access package bundles the groups, Teams and enterprise applications belonging to a business role; its policy names who may request it, which approval stages apply, and when the assignment expires unless renewed. That is configuration, not development, but it is licensed: entitlement management and access reviews need Microsoft Entra ID P2 or Microsoft Entra ID Governance for every user in scope, and neither sits in Microsoft 365 E3 or P1.
The other half is what the directory does not reach, about half the applications here: SAP roles, the policy administration system and two on-premises tools, all granted in their own screens. When an assignment is approved, the instruction for those systems lands in a UiPath Orchestrator queue; a robot performs the grant with its own named account, reads the account back and confirms it against the request. Reversed, the same routine withdraws access, so one catalogue covers the whole estate.
Reviews divide the same way. Microsoft Entra ID Governance recertifies directory-managed access on a schedule and applies the decisions itself. For the rest, robots collect each application's user list, join it with directory and last-use data and build one pack per manager: the person, the entitlement, what it means in business terms, when it was last used, who asked for it, and any conflict flag. The manager works the pack as a UiPath Action Center task in Microsoft Teams, with a deadline and an escalation. Day-one provisioning and privileged-access monitoring are separate builds.
Microsoft Entra ID Governance entitlement management (access packages, requestor scope, multi-stage approval, time-limited assignments) and access reviews (scheduled recertification, automatic application of results); UiPath Orchestrator queues, credential stores and audit log; UiPath Action Center tasks inside Microsoft Teams; Power BI
The access package catalogue and its owner map, robot grant and withdrawal routines with read-back verification, the review pack and its context fields, the decision-execution workflow, the evidence record and coverage reporting
SAP role assignment and user-list extraction through UiPath SAP activities and the SAP BAPI connector; the policy system and two on-premises applications driven through their own screens; the service desk through the ServiceNow or Jira Service Management connector
How the automated process works
- AutomationThe requester picks a business role from the catalogue; Microsoft Entra ID Governance routes it to the approvers the policy names and sets the expiry date
- SystemWhat the directory provisions is granted by Microsoft Entra ID itself; the rest becomes a grant instruction in an Orchestrator queue
- AutomationRobots grant in SAP and the on-premises applications, then read the account back and confirm the result
- AutomationEach quarter robots collect live user lists, join them with directory and last-use data and assemble one pack per manager
- PersonThe manager confirms, withdraws or reassigns each line in Microsoft Teams, giving a reason for anything kept past its expiry
- AutomationConfirmed lines keep their date; withdrawals become work items that robots execute and verify by reading the account back
- AutomationRequests, approvals, executions and decisions land in the evidence record and are reported in Power BI by application and owner
Human-in-the-loop model
Automation handles
- Routing each request to the owner the policy names, and setting the expiry date without anyone remembering to
- Granting and withdrawing where the directory cannot, then proving the change by reading the account back
- Collecting user lists, joining them with directory and last-use data, and assembling the review pack
- Chasing overdue reviews, escalating upwards and writing the evidence record
People decide
- Whether a request is justified: the owner named on the package, not whoever is on the service desk
- Whether an existing entitlement is still needed, line by line, in the quarterly review
- What to do about a conflict flag: accept it with a documented compensating control, or withdraw the conflicting right
- Which entitlements are too sensitive to expire quietly and must be withdrawn by a named person
Before and after
Systems and integrations
The stack is deliberately short: one engine, one execution layer, one place where a person decides.
Inputs
- access package requests from the My Access portal
- service-desk tickets from ServiceNow or Jira Service Management
- user lists collected by robots
- sign-in data from Microsoft Entra ID
Automation layer
- UiPath Orchestrator
- UiPath Robots
- UiPath Action Center
- UiPath Integration Service
Target systems
- Microsoft Entra ID and Microsoft Entra ID Governance
- SAP
- the policy and claims applications
- the service-desk tool
- the SharePoint evidence archive
Human touchpoints: approval stages in the access package policy; review tasks in Microsoft Teams; conflict decisions in Action Center
Technologies used
access packages, requestor scope, multi-stage approval and time-limited assignments wherever the directory reaches
Ascheduled recertification of group, application and role assignments, with results applied automatically
Agrant and withdraw in SAP and the on-premises applications; queues, retries, credential store, audit log
Areview and exception tasks completed inside Teams, with assignment, deadlines and escalation
AMicrosoft Graph identity data, Teams and SharePoint, SAP BAPI, ServiceNow or Jira Service Management
Acatalogue coverage, review completion, ageing entitlements and dormant accounts for the CISO
AIllustrative economic model
Numbers you can check against your own data.
Nothing below was counted at a client: it is a model on stated assumptions, and every input is open to challenge. Twelve minutes is a blended average, from a directory group added in two minutes to a request spanning SAP, the policy system and a shared mailbox. €36 an hour is a fully loaded internal cost for an IT administrator in Central Europe. The result is capacity released, not headcount removed; the review cycle is costed separately under the cost of inaction.
Run the numbers on your data
An illustrative estimate from your own inputs. It models released capacity; it is not a promise of savings.
Business benefits
- People start working on the day they are given the job, because an approved request is provisioned everywhere, not only in the connected systems
- Administrator time moves from typing grants to running the estate, and the same team absorbs growth without recruitment
- Access ends by default: every assignment carries a date, so an entitlement nobody needs disappears without anyone noticing
- Approvals become decisions, because the owner sees a business role and its conflicts instead of a group name
- Reviews produce withdrawals rather than signatures, and audit evidence accumulates as a by-product of the flow
The management view
- Access stops being a favour granted by IT and becomes a decision taken by whoever carries the risk, on a record that outlives them
- Coverage becomes measurable: which applications are in the catalogue, which entitlements have an owner and a date, which are still granted by hand
- The quarterly review turns into a managed process with a deadline, an escalation path and a completion rate
- Preparing for an audit stops being a project, because the evidence already exists in the form the reviewer wants
Board-level KPIs
Security and governance
Control is not an add-on.
- Robots hold their own named administrative accounts, with only the rights their routines need; passwords live in whichever store the Orchestrator is configured against, Azure Key Vault or CyberArk, and are rotated there
- A robot executes decisions and never makes one. Every grant traces to an approval in the access package policy or to a review decision recorded against a named manager
- Whoever changes robot rules is not whoever approves access, and rule changes follow the normal release path into production
- Your Microsoft 365 tenant and the EU region of UiPath Automation Cloud hold all of it: directory data, decisions and evidence; privileged and break-glass access is excluded from silent expiry and withdrawn by a person
Why now
Identity and access management is now examined by supervisors directly rather than inferred from policy documents. Regulation (EU) 2022/2554 (DORA) has applied to financial entities since 17 January 2025, and the practical question is plain: show who approved this access, when, and when it was last confirmed
The modelled €13,680 a month of administrator handling continues until the catalogue exists, as does the €21,600 a year the review cycles cost by hand
The pieces are mature and native, and the half of the estate they cannot reach is ordinary robot work rather than a development project
Relevant executive roles
Fulfilment stops consuming the administration team, and the estate has one catalogue instead of sixty administration screens
Every entitlement gains an owner, a reason and a date, and the review starts producing withdrawals rather than signatures
Evidence per request and per decision exists continuously, with no annual reconstruction exercise
People start work on the day the job starts, instead of managers reassigning what a colleague cannot open
Common questions and objections
Entitlement management governs what the directory can provision, which here is about half the applications. SAP roles, the policy system and the on-premises tools are still granted in their own screens. Robots do that work and read the account back to prove it, so one catalogue covers the whole estate.
They will if the task looks the same. A line carrying the business role, the last recorded use, who requested it and any conflict flag is a different decision, and it arrives with a deadline and an escalation rather than as an attachment. Withdrawal rates then become visible per manager.
Microsoft lists SAP business roles as an access-package resource type in Preview. We do not put production controls on Preview features, so the package carries the request, the approval and the expiry while a robot performs the SAP assignment. If that reaches general availability, the robot step retires without the catalogue changing.
When this is not the right solution
- A small estate with a handful of applications and a few dozen access changes a month, where a documented role matrix costs less than the licences
- No application owners, and no appetite to name any. If nobody will put their name against an entitlement, faster routing only makes the rubber stamp more efficient
- Reporting-line data is unreliable, in which case the review has nobody to send anything to and the HR feed into the directory comes first
A question for the next management meeting
Which of our applications could tell us today, without a project, exactly who has access, who approved it, and when anyone last confirmed it is still needed?
Implementation approach
A scope without ambiguity, before anything is signed.
We deliver
- Discovery across the estate: what the directory can provision, what needs a robot, who owns each application
- The access package catalogue: business roles, requestor scope, approval stages, assignment duration and the owner map behind them
- Robot grant and withdrawal routines per disconnected application, each with read-back verification and a rollback path
- The quarterly review pack and the execution of its decisions, with an exception route for anything a robot cannot complete
- The evidence record and the Power BI layer for coverage, completion, ageing and dormant accounts
We need from you
- The application inventory with an owner named for each, and an honest view of what the directory provisions today
- Read access to current user lists and one quarter of access-request history
- A decision on the licence position before design starts
- The segregation-of-duties conflicts you already recognise, however informally
Stages
Discovery
Application estate, owners, user lists, request volumes and the directory-versus-robot split
Design
Catalogue structure, business roles, approval stages, assignment durations, review scope, conflict table
Build
Access packages, robot routines, review pack assembly, Teams tasks and the evidence record
Validation
Dry run on historical requests, and one review cycle run beside the existing spreadsheet
Go-live
One department and its applications first, then the wider estate, with hypercare
Optimisation
Coverage reporting, catalogue tuning, extending robot fulfilment to further applications
Departmental. Effort follows how many applications sit outside the directory, how readily each produces a user list, whether owners can be named without an escalation, and how much business-role structure must be created from scratch.
Which of your applications could name their owner today?
Send us your application inventory, marking what Microsoft Entra ID already provisions, plus one quarter of access-request volumes. You get back a catalogue design, the split between native and robot fulfilment, and a written estimate of what the review cycle costs you now.
Let us cost your access reviewsThe neighbouring process usually has the same problem
New starters wait days for access; leavers keep theirs for weeks. Both are the same missing handover.
View solution Legal & complianceSegregation of duties checked weekly, not once a yearThe auditor finds your role conflicts once a year. By then the oldest of them is twelve months old.
View solution IT & servicesSoftware licences reconciled every monthLeavers, duplicates and dormant accounts keep their paid seats until somebody rebuilds the list by hand.
View solutionIndustries we deliver this in most oftenManufacturing & industryFinance & insuranceShared services