55 Problems You Can Solve with User Access Review
Anyone who works with company user identities on a daily basis eventually runs into the same questions – on Reddit, in IT forums, or over coffee with the managing director. We’ve collected 55 of them and answered how User Access Review (UAR) solves them in practice.
A. Leavers, movers and long absences
How can I make sure former employees no longer have access to our systems?
Answer: With a Squarum User Access Review, the user list of each system is imported and a reviewer must approve or revoke every account. Former employees who are still listed show up immediately, the decision is documented, and the removal is tracked as a corrective action. In Excel nobody can prove the list was complete or unchanged.
How do I find accounts that our offboarding checklist missed (specialist apps, SaaS tools, shared tools)?
Answer: Offboarding usually covers AD and Microsoft 365. Squarum reviews each application separately, so accounts that exist only inside a CRM, ERP, ticket system or marketing tool are put in front of the responsible reviewer.
How do I catch employees who changed department but kept their old permissions (privilege creep)?
Answer: In Squarum the reviewer sees each user together with the current role and must confirm or revoke it. Someone who moved from finance to marketing but still has finance rights is caught at the next review, and the decision stays in the audit trail.
How do I check access of people on long sick leave, parental leave or sabbatical?
Answer: Include these users in the Squarum user access review. The reviewer can revoke or restrict access for the absence period, and the reason and date are logged. A spreadsheet note “on leave” proves nothing.
How do I make sure contractors, interns and temporary staff lose access when their contract ends?
Answer: Import external users into Squarum like any other users. The reviewer decides per person, and recurring reviews catch expired contracts that nobody reported to IT.
How do I find dormant or forgotten accounts?
Answer: Squarum makes a reviewer actively decide on every account in the import. An account nobody can justify gets revoked instead of silently surviving for years.
How do I find shared, generic or service accounts that nobody owns?
Answer: Each user in a Squarum user access review needs an assigned reviewer. Accounts without a clear owner become visible during assignment, which forces someone to take responsibility or remove them.
IT cannot know which people still need access to departmental apps. Who decides if access is revoked or granted?
Answer: The Squarum App Owner Portal delegates user access reviews to the business owners of each application. They know their team, and IT gets the documented result.
How do I prove to management that offboarding really worked?
Answer: Completed Squarum user access reviews show which accounts were found, who were reviewed, and which accounts were revoked.
How do I see how long ex-employees kept access after their last day?
Answer: The Squarum event log timestamps every decision and corrective action, so the gap between review findings and removal can be shown and improved from review to review.
How do I handle access after a reorganization, merger or layoff round?
Answer: Start a user access review campaign across all critical apps. Squarum is up in minutes without an implementation project, so the access review is done when the reorganization happens, not months later.
How do I handle guest and external accounts in Microsoft Entra ID?
Answer: Import users from Entra ID (or CSV/API) into Squarum and review guests together with employees, so external accounts without a business justification get revoked.
B. Privileges and roles
How do I find out whether too many people have admin rights?
Answer: The user access review shows each user’s role per app. Squarum puts every admin role in front of a reviewer who must question it, and the approval of each one is documented.
How do I enforce least privilege?
Answer: In Squarum the reviewer checks not only whether a person should have access but whether the access level is appropriate, and can revoke or request a lower role.
How do I review privileged accounts more often than normal accounts?
Answer: Run separate Squarum reviews for admin and privileged accounts at a shorter interval.
How do I detect conflicting roles (segregation of duties)?
Answer: Squarum’s rules, controls and alerts are designed to flag conflicts and abnormalities during a user access review. Reviewers see the person’s full role picture instead of one isolated line in a spreadsheet. (Confirm rule scope before publishing.)
Temporary access was granted "just for now" and never removed. How do I stop that?
Answer: Temporary rights appear in the next Squarum user access review as ordinary accounts. The reviewer has to justify or revoke them, so they cannot become permanent by neglect.
C. Costs
How do I stop paying licenses for people who left the company?
Answer: An account that is revoked in a Squarum user access review review can be removed or downgraded by the app owner, so the license is freed. Doing this regularly cuts the cost of unused seats.
How do I find people who have a license but no longer need the app?
Answer: In Squarum reviewers confirm that each user still needs the app and the role. Unneeded access and the cost behind it are reduced after each user access review.
How do I avoid overpaying at SaaS renewal or license audits?
Answer: Run a Squarum user access review shortly before renewal and renegotiate with a verified user count instead of an inflated one.
How do I reduce the staff time spent on user access reviews?
Answer: With Squarum there is no mailing of spreadsheets, no manual merging, no chasing. Reviewers work in a portal, alerts handle reminders, and the admin console shows the progress.
How do I avoid the cost of audit findings and repeated audits?
Answer: With Squarum, auditors find the evidence ready, with decisions, timestamps and results in one place. This avoids nonconformities for missing access reviews and expensive follow-up audits.
We cannot afford a big identity governance project. What is the alternative?
Answer: Squarum is built for User Access Reviews only. The free plan has no time limit, and a first review can start in about 10 minutes without an implementation project.
D. Audit and evidence
The auditor asks for proof that user access reviews were performed. What do we show?
Answer: Every user access review, decision and action is stored in Squarum and exportable. Excel files are not audit-proof: they can be changed afterwards and show no history.
How can I prove that the user access review records were not manipulated?
Answer: The full Squarum event log and audit trail record who did what and when. A spreadsheet can be edited without a trace, which is why auditors are suspicious of it.
Who approved which access, and when?
Answer: In Squarum each user has a status (approved or revoked), the reviewer and the time. This answers an auditor’s question in seconds.
How do I keep user access review history across years?
Answer: Completed user access reviews remains saved in Squarum in one location with results and audit trail, so you can compare year over year and show that the process is continuous.
Reviewers just click "OK" or never respond. How do I manage that?
Answer: The Squarum admin console shows upcoming, ongoing and completed user access reviews, and alerts and notifications track progress and delay. Every answer is logged against a named person.
We have five versions of the user access review spreadsheet in email threads. How is Squarum better than Excel?
Answer: There is only one record in Squarum: one user access review, one status, one history, with no version conflicts.
How do I prove that revoked access was actually removed?
Answer: Squarum manages and tracks corrective actions such as user removals after the user access review, so the loop from finding to fix is documented.
How do I prepare for an audit at short notice?
Answer: Squarum keeps results, decisions and trails in a single location, so the evidence does not have to be assembled from folders and mailboxes.
User lists with names and roles travel by email. Is that a data protection problem?
Answer: It can be. In Squarum the data stays in the platform and reviewers work in a portal with built-in SSO and MFA instead of forwarding files.
How do I secure the user access review tool itself?
Answer: Squarum supports Single Sign-On and Multifactor Authentication on all plans.
E. Regulations and frameworks
How do I show ISO 27001 Annex A 5.18 (access rights) is met?
Answer: 5.18 requires access rights to be provisioned, reviewed, modified and removed. Squarum documents the periodic review and the resulting changes. (In the 2022 edition, 5.18 merges the former 9.2.2, 9.2.5 and 9.2.6.)
How do I cover ISO 27001 privileged access (Annex A 8.2)?
Answer: Run separate, more frequent user access reviews of admin and privileged accounts in Squarum and keep the evidence.
What proves SOC 2 logical access controls (CC6.1 to CC6.3)?
Answer: Auditors want evidence that access is authorized, reviewed and removed when no longer needed. Squarum review records with timestamps and reviewer names are that evidence.
How do I meet GDPR data minimisation and security (Art. 5(1)(c), 5(1)(f), 32)?
Answer: Only people who need personal data should have access to it. Regular Squarum reviews of the apps that hold personal data document that this is checked and corrected.
How do I reduce the risk of a GDPR breach caused by a former employee (Art. 33)?
Answer: Removing stale accounts found in Squarum closes the door that ex-employees would use. If something happens anyway, the audit trail shows the controls you had in place.
How do I meet NIS2 requirements on access control and HR security (Art. 21)?
Answer: NIS2 expects access control policies and security in HR processes. Regular documented reviews in Squarum show management that they are enforced, which matters since management is accountable.
How do I handle HIPAA access and termination requirements (e.g. §164.308(a)(3) and (a)(4))?
Answer: Review access to systems holding ePHI regularly. Squarum finds terminated staff and role changes and documents who decided what.
How do I comply with PCI DSS 4.0 (user account review, e.g. 7.2.4, and removal of terminated users, e.g. 8.2.5)?
Answer: Run periodic Squarum reviews of accounts with access to cardholder data environments and keep the results as evidence. (No Squarum PCI DSS landing page exists yet; this is a gap.)
How do I support SOX IT general controls on user access?
Answer: Squarum access reviews of financially relevant systems, with approver, date and outcome, are a standard ITGC evidence item.
How does a UAR help with CCPA/CPRA?
Answer: CCPA does not name user access reviews directly. The case for Squarum is indirect, via data minimisation and reasonable security (§1798.100(c), (e)). Keep the honest framing used on the existing page.
How do financial entities meet DORA ICT risk management expectations on access?
Answer: Access rights to ICT systems must be controlled and reviewed. Squarum provides the recurring, documented review for that part. (Verify the exact DORA articles first.)
How do automotive suppliers satisfy TISAX / VDA ISA access control questions?
Answer: Assessors ask for evidence that access rights are checked regularly. Squarum records show it.
How do German organizations show BSI IT-Grundschutz identity and authorization management (ORP.4)?
Answer: Periodic review of permissions is part of this module, and Squarum covers it. Review results and audit trail are your proof.
How do we answer cyber insurance questionnaires about access reviews?
Answer: Insurers ask whether access is reviewed regularly and whether leavers are removed. Squarum shows both with documented reviews.
Customers send security questionnaires asking "Do you perform periodic user access reviews?" How do we answer credibly?
Answer: “Yes, with Squarum, a dedicated platform that records every decision in an audit trail.” This is stronger than “yes, in Excel” and shortens due diligence.
How do we map our reviews to CIS Controls or NIST account management requirements?
Answer: Account inventory, removal of dormant accounts and revocation on termination are standard controls. Squarum reviews with documented results cover them.
F. Organization and practicality
Nobody is clearly responsible for access, so it goes unchecked. How do I handle this in Squarum?
Answer: Squarum assigns each review to named reviewers and app owners, so responsibility is visible and measurable.
Business managers do not understand IT roles and find user access reviews hard. How do I handle this in Squarum?
Answer: The Squarum Reviewer Portal is made for reviewers, with a simple approve-or-revoke decision per person and role. No training is needed according to G2 reviewers.
We are a small company without an IT department. Does this prevent us from using Squarum?
Answer: No. You can set up Squarum in minutes. The onboarding needs no sales contact or credit card. The inly information you need to start a user access review is the app name and who is responsible for the app (app owner).
We use many apps and have no overview of who has what. Does this prevent us from using Squarum?
Answer: Number of apps and users is unlimited ion Squarum. Squarum collects review data for all apps in one place with a central view of ongoing and completed reviews.
Some apps have no API or SSO integration. How do I review them anyway?
Answer: Squarum accepts CSV import or copy/paste from Excel, plus Entra ID or custom API imports where available. No integration project is needed to start.
We are an MSP or consultancy and must run reviews for several customers. Is Squarum MSP-friendly?
Answer: The Squarum Enterprise plan is aimed at MSPs and large organizations, with multiple sites, custom branding and integrations.
Our user access review process differs from team to team. How does Squarum support this?
Answer: Squarum unifies steps and rules (user, reviewer, role, status), so every review follows the same process and produces comparable results.
Register now and perfom your first user access review in 10 minutes.
Squarum comes with a free plan that includes a maximum of 50 annual user access reviews.