Conduct a SaaS Administrative Access Review

Scenario

Brightquarry Analytics (a fictional 60-person data-services company) has committed to quarterly access reviews after a customer security questionnaire asked, pointedly, when the last one occurred. You are the IT administrator running the first cycle, scoped to administrative roles in four systems: Google Workspace, the CRM, the code-hosting platform, and the payroll system.

The extract below is what you pulled from the four admin consoles this morning. All people and data are invented for this exercise.

Objectives

• Apply least-privilege reasoning to real-shaped access data.
• Make and document keep / reduce / remove decisions with named justification.
• Separate the decision (business call) from the remediation (technical change).
• Produce evidence that would satisfy an auditor sampling this quarter.

Evidence: admin-role extract

#	System	Account	Role	Last activity	MFA	Notes from consoles
1	Google Workspace	mchen	Super Admin	Today	Yes	IT administrator (you report to her)
2	Google Workspace	jpark	Super Admin	6 months ago	Yes	Former IT contractor; project ended in Q1
3	Google Workspace	svc-backup	Custom: Drive read-all	Today	N/A (key)	Backup integration service account
4	Google Workspace	rossi.a	User Management Admin	3 weeks ago	Yes	HR coordinator; resets passwords for new hires
5	CRM	mchen	Administrator	2 months ago	Yes	Set up the CRM originally
6	CRM	delgado.f	Administrator	Today	No	Sales operations lead; runs reports and imports
7	CRM	shared-sales-admin	Administrator	2 weeks ago	No	Shared login “for when Felix is out”
8	Code hosting	mchen	Owner	Today	Yes	—
9	Code hosting	tibbs.k	Owner	Today	Yes	Lead developer
10	Code hosting	wrenfield-dev	Owner	5 weeks ago	No	External dev agency account (engagement active)
11	Payroll	okafor.j	Full Admin	Today	Yes	Finance manager
12	Payroll	mchen	Full Admin	11 months ago	Yes	Added during payroll migration “temporarily”

Tasks

1. Load the extract into the access-review worksheet (or your own sheet), one row per account-role pair.
2. For each row, record a decision — keep, reduce, or remove — plus a one-line justification. For anything privileged that stays, the justification must state the business need, not “has always had it.”
3. Flag every finding that is a pattern problem rather than a single account (shared credentials, missing MFA on admin roles, external accounts without expiry).
4. Draft the remediation list: the specific changes to make, an owner for each, and a due date within ten business days. Note which changes need coordination (e.g., who confirms the dev agency’s engagement scope? what breaks if the payroll admin is removed?).
5. Write the two-paragraph evidence summary: scope, date, counts (reviewed / kept / reduced / removed), notable findings, and completion status of remediation.

Expected deliverables

• A completed worksheet with 12 documented decisions
• A pattern-findings list (expect at least four)
• A remediation plan with owners and dates
• A two-paragraph evidence summary suitable for an audit binder

Reflection questions

• Which decisions required information the extract could not give you — and who in the business holds it?
• Row 3 is a service account with broad read access. What is different about reviewing non-human identities, and what compensating expectations apply?
• Rows 2 and 12 are both stale, but are they the same severity? Why or why not?
• What would you change about scope or extraction to make next quarter’s review faster?

Optional advanced challenge

Write the three-sentence explanation you would send to the sales operations lead about why the shared admin login is being retired — persuasive, blame-free, and including the replacement arrangement. Sociotechnical remediation is half the job.

Defensive and ethical use

This exercise uses entirely fictional data to practice authorized access governance. Review real systems only with explicit authorization and through your organization’s change process.