IAM ACCESS RECERTIFICATION AT ENTERPRISE SCALE
Built for an enterprise security-operations group
A centralized access recertification platform replaced spreadsheet reviews across Microsoft Entra ID, Azure Bastion, SQL/Oracle databases and OS local accounts. Managers now certify access in a guided workflow, and every decision is retained as audit evidence.
By Yashwant Daniel · Solvstrat
Key
Facts
- Sector
- Security operations
- Built
- Multi-platform access recertification platform
- Stack
- Entra ID · Azure Bastion · SQL/Oracle · PostgreSQL
- Constraint
- Read-only collection; no inbound connectivity
- Outcome
- Audit-ready recertification with 12-month decision retention
Challenges
Access reviews were run manually across disconnected systems. Owners exported lists into spreadsheets, chased reviewers by email and had no reliable record of who approved what. The group needed least-privilege enforcement it could evidence to auditors.
Disconnected identity sources
Entra ID, Bastion, databases and local OS accounts each held a partial view of who had access to what.
Reviewer fatigue
Large, unstructured review queues led to rubber-stamping and missed revocations.
No defensible evidence
Spreadsheet approvals could not prove who reviewed which entitlement, or when.
Constraints
Collection must be read-only and must not modify production systems.
No inbound connectivity into restricted production segments.
Reviewers must only see the entitlements within their scope.
Decisions must persist immediately so a review can span multiple sessions.
Records must be retained for at least twelve months for compliance review.
Reference
Architecture
Collectors
Lightweight connectors read identities and entitlements from Entra ID, Azure Bastion, SQL/Oracle and OS local accounts. They run on a schedule and never write back to the source.
Entra ID · Azure Bastion · SQL · Oracle · OS accounts
Normalization layer
Different platforms describe access differently. This layer maps accounts, groups and roles into one entitlement model so reviews compare like with like.
Identity model · Entitlement mapping
Campaign and workflow engine
Builds review campaigns, assigns reviewers, tracks progress and stores approve, revoke and defer decisions with timestamps.
Campaigns · Reviewer queues · Reminders
Administration portal
Configuration for connectors, campaign scope and reviewer assignment, plus live progress across approved, revoked and pending items.
Admin portal · Encrypted connectors
Audit store
Immutable decision records, reviewer identity and evidence export, retained to meet the twelve-month compliance requirement.
PostgreSQL · Audit export
Data
Flow
- 1
Collectors read accounts and entitlements from each connected platform.
- 2
The normalization layer maps them into a single entitlement model.
- 3
A campaign is created for a scope, period and set of reviewers.
- 4
Reviewers approve, revoke or defer each entitlement in their queue.
- 5
Decisions are persisted immediately and progress updates in real time.
- 6
Revocations and evidence are exported and retained for audit.
Delivery
Data foundation
Connectors, entitlement model and identity correlation.
Campaign strategy
Scope rules, reviewer assignment and reminder logic.
Reviewer workflow
Queues, decision capture, progress and admin portal.
Lifecycle and enforcement
Revocation handling, retention and audit export.
Hard
Problems
Correlating identities across platforms
Problem: The same person appears as an Entra object, a database login and a local OS account with no shared key.
Resolution: A normalization layer matches on multiple attributes and keeps unmatched accounts visible for manual review rather than silently dropping them.
Reviewer fatigue
Problem: Long flat lists encourage rubber-stamping, which defeats the purpose of recertification.
Resolution: Queues are scoped by manager, grouped by entitlement type and prioritized by risk, with progress and reminder logic built in.
Evidence without agents
Problem: Production systems could not accept a persistent agent or inbound connection.
Resolution: Collection is scheduled and read-only, and evidence is assembled centrally from normalized records rather than pulled on demand.
Results
One review process
A single campaign covers identities across all connected platforms instead of separate spreadsheet exercises.
Faster reviews
Scoped queues, reminders and progress tracking reduce the time managers spend chasing access.
Audit-ready records
Decision history and revocation evidence are retained for at least twelve months.
Technology
Used
Microsoft Entra ID
Azure Bastion
SQL Server
Oracle
PostgreSQL
Lessons
Recertification succeeds or fails on reviewer experience, not on connector count.
Unmatched identities must be surfaced, never silently excluded.
Retention policy is part of the product, not an afterthought for audit.
CLIENT SUCCESS STORIES
More Case Studies
Explore how Solvstrat engineers custom digital architectures and software platforms for leading brands.
FAQ
Frequently asked questions
Access recertification is the periodic review of who has access to what, where managers confirm or revoke entitlements. It enforces least privilege and produces the evidence auditors expect. Automation replaces spreadsheets with scoped queues and a retained decision record.
The platform collects from Microsoft Entra ID, Azure Bastion, SQL and Oracle databases, and OS-level local accounts. Additional sources can be added through the same connector and normalization model.
No. Collectors are read-only and run on a schedule. They do not open inbound ports, hold persistent elevated sessions or change production configuration.
Decision history, reviewer identity and revocation evidence are retained for at least twelve months, with export available for compliance review.
SEE THE PROTOTYPE WE'D BUILD
Give us 30 minutes.
We'll show you the fix.
Tell us where the work slows you down. We'll come back with a prototype of the custom software, internal tools or automation we'd build to remove it — working in weeks, and you own the code.