SECURITY_GRCbeginner
User Access Review
Understand periodic User Access Review as a control over existing access, not just a checklist. Learn review scope, accountable reviewers, retain/remove decisions, privileged and dormant access, evidence, deprovisioning follow-through and automation.
Overview
Understand periodic User Access Review as a control over existing access, not just a checklist. Learn review scope, accountable reviewers, retain/remove decisions, privileged and dormant access, evidence, deprovisioning follow-through and automation.
Lessons in this topic
- SAP User Access Review Tutorial (Part 1)Learn how periodic access certification verifies that existing access is still appropriate and how revoke decisions must actually result in deprovisioning.
- User Access Review: Periodic Certification, Scope, Decisions and Evidence (Part 2)Run access certification as a risk-based control where accountable managers or role owners review actual user-role access and record keep, remove or remediate decisions with evidence.
- Identity and Access Review Automation: Joiner-Mover-Leaver, Dormant Users and Privileged Access (Part 3)Automate access governance around joiner-mover-leaver events, dormant-account detection and privileged-access review so periodic certification becomes the backstop rather than the only control.
Interview questions covered
- What are the core concepts of User Access Review, and how would you explain them clearly in an SAP interview?
- How would you apply User Access Review in a real SAP project? Walk through the design or implementation approach.
- A production issue is reported in User Access Review. What would you check first, and how would you troubleshoot it systematically?
- What are the most important design decisions, trade-offs, and best practices in User Access Review?
- Suppose you inherit an existing User Access Review solution. How would you review it before making a change?
- Using this SAP project situation — Run a quarterly review for a finance team, remove roles from employees who changed jobs, and verify those roles disappeared from the target systems — explain User Access Review Fundamentals. What should happen, which concepts or process steps matter, and what common mistake would you avoid?
- You are the senior consultant/architect responsible for User Access Review: Periodic Certification, Scope, Decisions and Evidence. The project situation is: A manager revoked a sensitive role during quarterly certification, but the role remained assigned because the review tool was not integrated with deprovisioning. How would you assess the design, identify the highest-risk failure modes, and define the evidence required before approving it for production?
- You are the senior consultant/architect responsible for Identity and Access Review Automation: Joiner-Mover-Leaver, Dormant Users and Privileged Access. The project situation is: An employee changed from purchasing to finance and received the new finance roles, but purchasing roles were never removed. How would you assess the design, identify the highest-risk failure modes, and define the evidence required before approving it for production?