Access reviews

An access review lists your privileged accounts and asks you to mark each one Keep or Remove. Velauth signs the result on its servers so an auditor can rely on it.

Who can use it

• The Manage compliance reviews permission (compliance.reviews.manage) to start and submit a review.
• A plan with compliance reports. The app says it is included with every active plan.

Without the permission the screen says “Your role cannot submit access reviews. Ask an Admin or Owner.”

Run a review

1. Open Reports under Operations and find Privileged access review.
2. Read the status line. It tells you when the last review was and whether one is due. The cadence is 90 days.
3. Select Start review. Velauth loads the accounts from your connected domain.
4. For each account, choose Keep or Remove. The table shows the groups that make it privileged, whether it is enabled, and its last sign-in. You can add a short comment.
5. Select Submit review. It unlocks only when every account has a decision.
6. Read the confirmation, then select Confirm and record.

Limits

• One review holds at most 500 accounts. If more are found, the review cannot be submitted.
• You can submit 20 reviews an hour.
• If the agent did not say whether an account is privileged, the account is still listed and flagged. Decide on it like the others, or update the agent first.

What is recorded

• The review is stored and signed. Once recorded it cannot be edited or deleted.
• The admin audit gets an access_review_submitted entry with counts only: how many kept, how many removed. It never holds account names or comments.
• The desktop app also writes a local audit entry, AccessReviewSubmitted, with counts only.

What it does not do

• It does not remove anyone. Marking Remove only records your decision. After you submit, Velauth lists the accounts to remove, and you remove them from the privileged group in Groups yourself.
• It does not remind you by email. The only prompt is the status line on the Reports page.