Access reviews

An access review is a point-in-time record of who had access to each app in your environment, a decision to approve, remove, or change that access, and any remediation needed based on those decisions.

How access reviews work

To complete an access review, you need to follow a few steps:

Define scope. Choose which apps are in scope for this review.
Capture accounts. Identify users in those apps, and what level of access they have.
Review each account. Make a decision for every account in an app, to approve, remove, or change the access.
Complete the review. Once all accounts have been reviewed, mark the entire review as complete.
Remediate any access. Work through any identified access removals or changes, and capture evidence these have been remediated.

Create an access review

You must be an admin to start an access review.

From the Reviews page, select New access review to create a new review.

Oblique names each access review based on the date you start it.

Define the scope of a review

You must be an admin to define the scope of a review.

From an access review,

Under Scope, select Define scope. This will open a dialog where you can select the apps to include in the review.
To add apps, in the app’s row, select Add to include it in the scope of the review. Apps are suggested from your identity providers and from those commonly included in access reviews. You can also search for apps to add them.
Optionally, if you have apps not included in the list of known apps, such as internal apps, select Add custom app to add them. Enter the app name then select Add to scope.
Remove any selected apps from the scope by selecting Remove.
Select Start review.

If you haven’t connected an identity provider yet, we recommend you connect one first to import apps and accounts from the identity provider.

Edit the scope of a review

If you’ve previously completed an access review, Oblique automatically carries forward the scope from your most recent review to use, and so you will need to edit and confirm the preselected scope. From an access review,

Select Edit scope to reopen the dialog to edit the review’s scope. Search for apps to Add them or Remove them from the scope.
Select Save scope to save the edited scope.

Confirm the scope of a review

Once you have finished defining the scope of the review, select Confirm scope to start the review.

Oblique will capture the accounts from integrations for those apps at the moment in time the scope has been confirmed. The scope can still be edited, but accounts will need to be recaptured once the scope is reconfirmed.

Capture accounts in an app

Oblique automatically captures accounts from integrations with your identity providers and directly with your apps, so access reviews begin with a list of known accounts. Where a direct integration doesn’t exist, you should capture the accounts in the app, as this may be different from what is given by your identity provider. Oblique lets you capture the account list from the app itself either by uploading a screenshot or by pasting in the list of users.

You must be an admin to add accounts to an app in a review.

Sync accounts from an integration

Where an integration exists, but isn’t yet configured in your tenant, this will show in your list of scoped apps:

Select Connect integration to open the app.
Select Add integration, then follow the instructions for each integration, prior to returning to the review.

Once connected, accounts in those integrations will automatically be captured and appear in the review.

Manually add accounts

Where no integration exists, you will need to manually capture and add accounts to Oblique. You can do this by uploading a screenshot, or by pasting in a list of accounts.

From a review, select an app to open it,

Under Sources, select Add accounts.
Open the app to find its list of users. Where Oblique knows where to find the app’s user list, it will link directly there. Some apps have information about users and admins on separate pages, so make sure to capture both.
To upload a screenshot, under the Upload screenshot tab, drop or paste a screenshot of the app’s member list, with the column headings visible. We also suggest you capture the date and time in your screenshot. You can add several screenshots. Oblique will automatically parse the screenshots for account information.
Optionally, if you prefer to paste a list of users, under the Paste emails tab, paste a list of emails from the app, separated by commas or new lines. You can also select all the text on the app’s user list page and paste it, and Oblique will extract the emails. Select Add accounts.

Any uploaded screenshots are kept as evidence for the review, and can be opened under Sources. This includes when and where it was captured and which accounts were read from it.

Remove accounts

You can edit accounts to remove accounts that were manually added. You cannot remove accounts that were captured by an integration.

To remove a manually added account, in a review, select an app to open it,

Under the Accounts table, find the relevant account.
In the More menu on the account’s row, select Remove account.

To remove all of the accounts that a screenshot added, remove the screenshot instead:

Select the screenshot chip under Sources.
Select Remove screenshot….
Select Remove.

Review accounts

Every account in an app needs a decision in order to complete the review. For each row, decide:

Approve: keep the account’s current access as is
Remove access: the account shouldn’t have this access, and it should be removed during remediation
Change access: the account should have a different level of access, and it should be changed during remediation
Out of scope: the account isn’t part of this review, such as a service account

Removing and changing access create remediation items.

You must be an admin to review accounts.

To review an account,

On the account’s row, select Review.
Select a decision.
Optionally, select Add note… to record a rationale, then select Save note. Choosing Change access prompts you for a note, to note what the change should be.

Each decision records who made it and when, plus any notes. To remove a decision, select Clear decision.

Review accounts in bulk

Many accounts in a review will have the same decision, so you can take bulk actions to review these:

Select the checkbox on each account you want to decide, or the checkbox in the table header to select every account currently shown.
From the bar at the bottom, select Approve or Remove access. For the other decisions, notes, or to clear decisions, select the More menu.

You can also use the filters above the accounts table to see All accounts, Needs review, or accounts with a specific decision, as well as search the table for specific users.

Select Approve remaining at the top of the app to approve every account in an app that doesn’t yet have a decision.

Complete a review

You can complete a review once its scope is confirmed and every account has a decision.

You must be an admin to complete a review.

From the review, select Complete review.

Once the review is completed, its scope, accounts, and decisions can’t be changed. Remediation items might need to continue after the review is completed, so these are still editable.

Re-open a review

If you completed a review too early, you can re-open it to change its scope, accounts, and decisions:

From the review’s header, select More.
Select Re-open review….
Select Re-open.

Export a report of the review

Once a review is completed, you can export it as a PDF for your auditor. Oblique generates a report that includes the review’s date, who generated it, how many apps and accounts it covered, and a breakdown of the decisions. For each app, this lists its accounts, each account’s decision, who reviewed it and when, and any notes.

To generate the PDF report export, from the review, select Export report.

Remediate items from a review

Access you decided to remove or change in a review becomes remediation items for you to complete after the review.

You must be an admin to remediate items from a review.

Remediation items only appear if the review has any, that is, access you decided to remove or change. To complete remediation items, from a review, select Remediation:

For each app, complete the remediation items listed in the app itself, to remove or change access for each account.
Once completed, select the item’s checkbox to mark it done.
Optionally, select Add evidence to add a screenshot of the remediation. Drop or paste a screenshot of the app’s member list, audit logs, or other evidence of the change.

Remove remediation evidence

From the review, select the app you added the evidence for,

Under Evidence, select the screenshot’s chip to open it.
Select Remove evidence….
Select Remove.

Delete a review

Deleting a review removes it, along with its apps, accounts, decisions, and evidence.

You must be an admin to delete a review.

From the review’s header, select More.
Select Delete review….
Select Delete review.