Simplify compliance
without manual overhead

An user access review is a process of evaluating and verifying the access rights of employees, contractors, or other users to an organization's applications, and data. It involves reviewing user accounts, permissions, and roles to ensure that they are appropriate and necessary for the user's job responsibilities. User access reviews help organizations identify and remediate any potential security risks or compliance violations.

The frequency of user access reviews depends on the size of the organization, the complexity of systems, and the level of risk associated with the data being accessed. However, it is recommended that user access reviews should be conducted at least annually, or more frequently for high-risk systems or sensitive data. Opal decreases the manual burden of access requests by delegating reviews to the appropriate owners and automating notifications, access propagation, report-generation, and more. This allows companies to run access reviews more often.

User access reviews should involve a cross-functional team of stakeholders to ensure that access rights are appropriate and necessary for each user. The team should include IT or engineering admins, data owners, compliance officers, and business unit managers. With Opal, it’s easy to automatically assign reviews based on resource owner and/or managers.

User access reviews should review all types of access that employees, contractors, or other users have to an organization's IT systems, applications, and data. This includes access to sensitive data, privileged accounts, administrative functions, and third-party applications. Opal automatically discovers and imports applications for organizations to easily streamline the user access review process.

Opal covers a broad set of integrations including applications imported from identity providers, such as Okta, and native applications with cloud Infrastructure, such as AWS, Github, GCP, and SaaS Applications, such as Salesforce. For the full list of connections, please go to https://opal.dev/integrations.

Don’t see one on the list? Opal has a custom application API. Additionally, our engineering team can create connectors for you.

Yes! Opal has write permissions so it can automatically propagate access changes to end systems. At the end of the audit, Opal will generate an auditor friendly report to summarize all of the actions.

Opal has two access propagation methods – automatic access propagation or manual activity tracking with ticketing providers. For the latter, Opal will create a ticket in your ticketing provider to kick off provisioning workflows. Additionally, Opal will sync with the ticket status to indicate whether the activity has been completed or not.