{"id":285,"date":"2026-11-02T20:39:43","date_gmt":"2026-11-02T19:39:43","guid":{"rendered":"https:\/\/theitlead.com\/blog\/?p=285"},"modified":"2026-11-02T20:39:43","modified_gmt":"2026-11-02T19:39:43","slug":"access-review-software","status":"publish","type":"post","link":"https:\/\/theitlead.com\/blog\/access-review-software\/","title":{"rendered":"Best Access Review Software for Small IT Teams"},"content":{"rendered":"\n<div class=\"ok-byline\"><div class=\"ok-who\"><span class=\"ok-avatar\" aria-hidden=\"true\">MB<\/span><div><strong>Reviewed by Max Benz<\/strong><span>Updated <time datetime=\"2026-11-02\">November 2, 2026<\/time> \u00b7 30 min read<\/span><\/div><\/div><ul class=ok-chips><li class=\"ok-chip ok-chip--ok\">Prices and docs read on vendor pages, November 2, 2026<\/li><li class=\"ok-chip ok-chip--ok\">Ratings read on G2, November 2, 2026<\/li><li class=\"ok-chip ok-chip--ok\">No sponsored placements in this comparison<\/li><\/ul><\/div>\n\n\n\n<p class=\"wp-block-paragraph\">Access review software asks the right person to confirm, tool by tool, who still needs which access, records each keep-or-remove answer and keeps the evidence an auditor asks for. This page compares eight tools for IT teams of roughly 3 to 50 people and MSPs without a dedicated identity governance team, and it follows one quarterly review of a finance app through each product, from setting the scope to the report that leaves the tool.<\/p>\n\n\n\n<p class=\"wp-block-paragraph\">The choice usually comes down to three questions: which identity platform you already pay for, whether a denied access is removed for you or only recorded, and whether you can live with a quote instead of a price. Only one of the eight tools publishes a price you can budget from, and that one is an add-on that needs a license you may not hold yet. Two tools, Vanta and Torii, leave the removal itself to a person, per their own help pages.<\/p>\n\n\n\n<nav class=\"ok-toc\" aria-label=\"On this page\"><p class=\"ok-toc__h\">On this page<\/p><ol><li><a href=\"#answer-picks-and-compare-table\">Answer, picks and compare table<\/a><\/li><li><a href=\"#what-access-review-software-does-and-what-it-doesn-t\">What access review software does and what it doesn't<\/a><\/li><li><a href=\"#how-often-to-run-access-reviews\">How often to run access reviews<\/a><\/li><li><a href=\"#what-to-look-for-in-access-review-software\">What to look for in access review software<\/a><\/li><li><a href=\"#how-we-chose-these-tools\">How we chose these tools<\/a><\/li><li><a href=\"#review-modules-inside-identity-platforms\">Review modules inside identity platforms<\/a><\/li><li><a href=\"#dedicated-identity-governance-for-lean-teams\">Dedicated identity governance for lean teams<\/a><\/li><li><a href=\"#saas-management-and-compliance-tools-with-access-reviews\">SaaS management and compliance tools with access reviews<\/a><\/li><li><a href=\"#what-the-licence-basis-costs-a-100-person-company\">What the licence basis costs a 100-person company<\/a><\/li><li><a href=\"#a-quarterly-review-routine-for-one-admin\">A quarterly review routine for one admin<\/a><\/li><li><a href=\"#service-accounts-and-non-human-identities-in-access-reviews\">Service accounts and non-human identities in access reviews<\/a><\/li><li><a href=\"#which-tool-fits-which-team\">Which tool fits which team<\/a><\/li><li><a href=\"#access-review-software-faq\">Access review software FAQ<\/a><\/li><\/ol><\/nav>\n\n\n\n<dl class=\"ok-stats ok-wide\"><div class=\"ok-stat\"><dt>access review tools compared<\/dt><dd>8<\/dd><\/div><div class=\"ok-stat\"><dt>publishes a price, Entra ID Governance at $7 per user per month<\/dt><dd>1<\/dd><\/div><div class=\"ok-stat\"><dt>leave the removal itself to a person (Vanta, Torii)<\/dt><dd>2<\/dd><\/div><div class=\"ok-stat\"><dt>G2 rating range across the seven tools with a G2 page<\/dt><dd>4.5 to 4.8<\/dd><\/div><\/dl>\n\n\n\n<h2 class=\"wp-block-heading\" id=\"answer-picks-and-compare-table\">Answer, picks and compare table<\/h2>\n\n\n\n<ul class=\"ok-picks ok-wide\"><li class=\"ok-pick\"><a href=\"#microsoft-entra-id-governance\"><span class=\"ok-fav ok-fav--md\"><img src=\"\/blog\/wp-content\/uploads\/opskit\/fav\/entra-id-governance.png\" alt=\"\" width=\"24\" height=\"24\" loading=\"lazy\" decoding=\"async\"><\/span><span class=\"ok-pick__tag\">Best if your people and apps already live in Microsoft Entra<\/span><span class=\"ok-pick__name\">Microsoft Entra ID Governance<\/span><span class=\"ok-pick__text\">Adds recurring reviews of groups, Teams and Entra-connected apps for $7 per user per month on top of Entra ID P1 or P2, with automatic removal of denied access.<\/span><span class=\"ok-pick__meta\"><span class=\"ok-chip\"><span class=\"ok-stars\" aria-hidden=\"true\">\u2605<\/span> 4.6 G2<\/span><span class=\"ok-chip\">$7\/user\/mo add-on<\/span><\/span><\/a><\/li><li class=\"ok-pick\"><a href=\"#conductorone-c1\"><span class=\"ok-fav ok-fav--md\"><img src=\"\/blog\/wp-content\/uploads\/opskit\/fav\/conductorone.png\" alt=\"\" width=\"24\" height=\"24\" loading=\"lazy\" decoding=\"async\"><\/span><span class=\"ok-pick__tag\">Best for campaigns that remove access through connectors<\/span><span class=\"ok-pick__name\">ConductorOne (C1)<\/span><span class=\"ok-pick__text\">Campaigns scoped by app, entitlement or user, routed to managers and owners, with denied access removed by the review policy or sent as a ticket. Quote only.<\/span><span class=\"ok-pick__meta\"><span class=\"ok-chip\"><span class=\"ok-stars\" aria-hidden=\"true\">\u2605<\/span> 4.8 G2<\/span><span class=\"ok-chip\">Quote only<\/span><\/span><\/a><\/li><li class=\"ok-pick\"><a href=\"#zluri\"><span class=\"ok-fav ok-fav--md\"><img src=\"\/blog\/wp-content\/uploads\/opskit\/fav\/zluri.png\" alt=\"\" width=\"24\" height=\"24\" loading=\"lazy\" decoding=\"async\"><\/span><span class=\"ok-pick__tag\">Best when service accounts must sit in the same review<\/span><span class=\"ok-pick__name\">Zluri<\/span><span class=\"ok-pick__text\">Certifications cover apps, groups and users, with a filter for service and API accounts and playbooks that remove access when the review ends. Quote only.<\/span><span class=\"ok-pick__meta\"><span class=\"ok-chip\"><span class=\"ok-stars\" aria-hidden=\"true\">\u2605<\/span> 4.6 G2<\/span><span class=\"ok-chip\">Quote only<\/span><\/span><\/a><\/li><li class=\"ok-pick\"><a href=\"#vanta\"><span class=\"ok-fav ok-fav--md\"><img src=\"\/blog\/wp-content\/uploads\/opskit\/fav\/vanta-access.png\" alt=\"\" width=\"24\" height=\"24\" loading=\"lazy\" decoding=\"async\"><\/span><span class=\"ok-pick__tag\">Best if SOC 2 or ISO 27001 evidence is the reason you review<\/span><span class=\"ok-pick__name\">Vanta<\/span><span class=\"ok-pick__text\">Reviews feed the same audit evidence page as your other controls, but a denial is tracked and not removed.<\/span><span class=\"ok-pick__meta\"><span class=\"ok-chip\"><span class=\"ok-stars\" aria-hidden=\"true\">\u2605<\/span> 4.5 G2<\/span><span class=\"ok-chip\">Quote only<\/span><\/span><\/a><\/li><li class=\"ok-pick\"><a href=\"#coreview\"><span class=\"ok-fav ok-fav--md\"><img src=\"\/blog\/wp-content\/uploads\/opskit\/fav\/coreview.png\" alt=\"\" width=\"24\" height=\"24\" loading=\"lazy\" decoding=\"async\"><\/span><span class=\"ok-pick__tag\">Best for a Microsoft 365 tenant only<\/span><span class=\"ok-pick__name\">CoreView<\/span><span class=\"ok-pick__text\">Templates for Teams, groups, SharePoint, OneDrive, guests and mailbox permissions, with periodic repeats and CSV export.<\/span><span class=\"ok-pick__meta\"><span class=\"ok-chip\"><span class=\"ok-stars\" aria-hidden=\"true\">\u2605<\/span> 4.6 G2<\/span><span class=\"ok-chip\">Quote only<\/span><\/span><\/a><\/li><li class=\"ok-pick ok-pick--ours\"><a href=\"#the-it-lead\"><span class=\"ok-fav ok-fav--md ok-fav--ours\"><img src=\"\/blog\/wp-content\/uploads\/opskit\/fav\/itl.svg\" alt=\"\" width=\"24\" height=\"24\" loading=\"lazy\" decoding=\"async\"><\/span><span class=\"ok-pick__tag\">Our product \u00b7 for the gaps between tools<\/span><span class=\"ok-pick__name\">The IT Lead<\/span><span class=\"ok-pick__text\">Records who owns each service account and whether that owner still needs it, from a CSV. It isn't an access review suite.<\/span><span class=\"ok-pick__meta\"><span class=\"ok-chip\">From $49\/month<\/span><\/span><\/a><\/li><\/ul>\n\n\n\n<div class=\"ok-compare ok-wide\" data-filter=\"1\"><div class=\"ok-scroll\"><table><thead><tr><th scope=\"col\">Tool<\/th><th scope=\"col\">Type<\/th><th scope=\"col\">Removes denied access?<\/th><th scope=\"col\">Price basis<\/th><th scope=\"col\" data-sort=num>Rating<\/th><\/tr><\/thead><tbody><tr data-cat=\"Review module inside an identity platform\"><th scope=\"row\"><span class=\"ok-tcell\"><span class=\"ok-fav ok-fav--sm\"><img src=\"\/blog\/wp-content\/uploads\/opskit\/fav\/entra-id-governance.png\" alt=\"\" width=\"18\" height=\"18\" loading=\"lazy\" decoding=\"async\"><\/span>Microsoft Entra ID Governance<\/span><\/th><td><span class=\"ok-job\">Review module inside an identity platform<\/span><\/td><td class=\"ok-muted\">Yes, auto-apply on groups and apps<\/td><td>$7.00 per user per month, paid yearly, as an add-on that needs Entra ID P1 or P2 (or Microsoft 365 E3 or E5) first; free trial offered. Entra ID P2 at $10 includes basic access reviews<\/td><td data-v=\"4.6\"><span class=\"ok-stars\" aria-hidden=\"true\">\u2605\u2605\u2605\u2605\u2606<\/span> 4.6 <span class=\"ok-muted\">(5)<\/span><\/td><\/tr><tr data-cat=\"Review module inside an identity platform\"><th scope=\"row\"><span class=\"ok-tcell\"><span class=\"ok-fav ok-fav--sm\"><img src=\"\/blog\/wp-content\/uploads\/opskit\/fav\/okta-identity-governance.png\" alt=\"\" width=\"18\" height=\"18\" loading=\"lazy\" decoding=\"async\"><\/span>Okta Identity Governance<\/span><\/th><td><span class=\"ok-job\">Review module inside an identity platform<\/span><\/td><td class=\"ok-muted\">Yes for individual assignments; group-based access needs manual removal unless auto-remove is on<\/td><td>No public price (quote only); sold as an add-on to Okta Workforce Identity, which has a $1,500 annual contract minimum<\/td><td data-v=\"0\"><span class=\"ok-muted\">No reviews yet<\/span><\/td><\/tr><tr data-cat=\"Dedicated identity governance\"><th scope=\"row\"><span class=\"ok-tcell\"><span class=\"ok-fav ok-fav--sm\"><img src=\"\/blog\/wp-content\/uploads\/opskit\/fav\/conductorone.png\" alt=\"\" width=\"18\" height=\"18\" loading=\"lazy\" decoding=\"async\"><\/span>ConductorOne (C1)<\/span><\/th><td><span class=\"ok-job\">Dedicated identity governance<\/span><\/td><td class=\"ok-muted\">Yes, through the review policy, or a ticket for apps without automation<\/td><td>Quote only; the pricing page offers platform pricing by managed identities (slider from 100 to 20,000) or monthly usage-based Flex pricing in C1 Tokens<\/td><td data-v=\"4.8\"><span class=\"ok-stars\" aria-hidden=\"true\">\u2605\u2605\u2605\u2605\u2605<\/span> 4.8 <span class=\"ok-muted\">(13)<\/span><\/td><\/tr><tr data-cat=\"Dedicated identity governance\"><th scope=\"row\"><span class=\"ok-tcell\"><span class=\"ok-fav ok-fav--sm\"><img src=\"\/blog\/wp-content\/uploads\/opskit\/fav\/lumos.png\" alt=\"\" width=\"18\" height=\"18\" loading=\"lazy\" decoding=\"async\"><\/span>Lumos<\/span><\/th><td><span class=\"ok-job\">Dedicated identity governance<\/span><\/td><td class=\"ok-muted\">Yes, across 100+ integrations (vendor claim)<\/td><td>No price published; the pricing page offers a demo and a free identity assessment<\/td><td data-v=\"4.7\"><span class=\"ok-stars\" aria-hidden=\"true\">\u2605\u2605\u2605\u2605\u2606<\/span> 4.7 <span class=\"ok-muted\">(69)<\/span><\/td><\/tr><tr data-cat=\"SaaS management and identity governance\"><th scope=\"row\"><span class=\"ok-tcell\"><span class=\"ok-fav ok-fav--sm\"><img src=\"\/blog\/wp-content\/uploads\/opskit\/fav\/zluri.png\" alt=\"\" width=\"18\" height=\"18\" loading=\"lazy\" decoding=\"async\"><\/span>Zluri<\/span><\/th><td><span class=\"ok-job\">SaaS management and identity governance<\/span><\/td><td class=\"ok-muted\">Yes, deprovisioning playbooks run when the review ends<\/td><td>No public pricing, demo request only<\/td><td data-v=\"4.6\"><span class=\"ok-stars\" aria-hidden=\"true\">\u2605\u2605\u2605\u2605\u2606<\/span> 4.6 <span class=\"ok-muted\">(177)<\/span><\/td><\/tr><tr data-cat=\"SaaS management with access reviews\"><th scope=\"row\"><span class=\"ok-tcell\"><span class=\"ok-fav ok-fav--sm\"><img src=\"\/blog\/wp-content\/uploads\/opskit\/fav\/torii-access.png\" alt=\"\" width=\"18\" height=\"18\" loading=\"lazy\" decoding=\"async\"><\/span>Torii<\/span><\/th><td><span class=\"ok-job\">SaaS management with access reviews<\/span><\/td><td class=\"ok-muted\">No automatic step stated; a remediation owner removes it<\/td><td>Quote only; the support doc says access reviews are available on the Enterprise plan and the Torii Identity module; Vendr buyer data shows a median of about $32,000 per year for the platform<\/td><td data-v=\"4.5\"><span class=\"ok-stars\" aria-hidden=\"true\">\u2605\u2605\u2605\u2605\u2606<\/span> 4.5 <span class=\"ok-muted\">(325)<\/span><\/td><\/tr><tr data-cat=\"Compliance automation with access reviews\"><th scope=\"row\"><span class=\"ok-tcell\"><span class=\"ok-fav ok-fav--sm\"><img src=\"\/blog\/wp-content\/uploads\/opskit\/fav\/vanta-access.png\" alt=\"\" width=\"18\" height=\"18\" loading=\"lazy\" decoding=\"async\"><\/span>Vanta<\/span><\/th><td><span class=\"ok-job\">Compliance automation with access reviews<\/span><\/td><td class=\"ok-muted\">No, a denial starts a remediation flow only<\/td><td>Quote only; Access Management starts at the Plus plan and may need an upgrade or add-on per the help center; free trial of about 5 to 7 days<\/td><td data-v=\"4.5\"><span class=\"ok-stars\" aria-hidden=\"true\">\u2605\u2605\u2605\u2605\u2606<\/span> 4.5 <span class=\"ok-muted\">(2,897)<\/span><\/td><\/tr><tr data-cat=\"Microsoft 365 governance\"><th scope=\"row\"><span class=\"ok-tcell\"><span class=\"ok-fav ok-fav--sm\"><img src=\"\/blog\/wp-content\/uploads\/opskit\/fav\/coreview.png\" alt=\"\" width=\"18\" height=\"18\" loading=\"lazy\" decoding=\"async\"><\/span>CoreView<\/span><\/th><td><span class=\"ok-job\">Microsoft 365 governance<\/span><\/td><td class=\"ok-muted\">Reviewer revokes; the docs we read don't say if finishing applies it in Microsoft 365<\/td><td>Quote only, per licensed Microsoft 365 identity; no minimum or trial stated<\/td><td data-v=\"4.6\"><span class=\"ok-stars\" aria-hidden=\"true\">\u2605\u2605\u2605\u2605\u2606<\/span> 4.6 <span class=\"ok-muted\">(119)<\/span><\/td><\/tr><\/tbody><\/table><\/div><p class=\"ok-note\">Prices and docs were read on vendor pages on November 2, 2026. Ratings are G2 scores read the same day. Entra ID Governance has 5 G2 reviews and ConductorOne 13, so treat those two as thin. Okta Identity Governance has no G2 page of its own, so we show no rating for it.<\/p><\/div>\n\n\n\n<p class=\"wp-block-paragraph\">Here's how to read the table, especially the removal column. Entra ID Governance is priced per user, Okta Identity Governance is an add-on to an Okta base plan, CoreView is priced per licensed Microsoft 365 identity, ConductorOne by managed identities or by usage, and the other four are quote only. The cost section further down puts one team size on the one scale that allows it.<\/p>\n\n\n\n<h2 class=\"wp-block-heading\" id=\"what-access-review-software-does-and-what-it-doesn-t\">What access review software does and what it doesn't<\/h2>\n\n\n\n<p class=\"wp-block-paragraph\">Access review software, also called access certification software, collects who has access to which systems, sends each reviewer a keep-or-remove list, records the answers and keeps the evidence an auditor asks for. A review campaign is one round of that process: a scope such as \"everyone in the finance apps\", a list of reviewers, a due date and a final report.<\/p>\n\n\n\n<p class=\"wp-block-paragraph\">Three parts do most of the work. <strong>Collection<\/strong> pulls accounts and permissions from your identity provider and apps through connectors, or from an uploaded file when an app has no connector. <strong>Routing<\/strong> sends each line to a reviewer, usually the person's manager or the app owner, with a fallback when no one answers. <strong>Remediation<\/strong> turns a \"remove\" answer into an actual change, either automatically through the connector or as a ticket someone has to close.<\/p>\n\n\n\n<p class=\"wp-block-paragraph\"><strong>What these tools don't do.<\/strong> Reviewing access isn't granting it. Provisioning and password rotation belong to your identity platform or a privileged access tool, and our guides to <a href=\"https:\/\/theitlead.com\/blog\/identity-and-access-management-software\/\">identity and access management software<\/a> and <a href=\"https:\/\/theitlead.com\/blog\/privileged-access-management-software\/\">privileged access management software<\/a> cover those. If you only need a checklist and a spreadsheet for a first review, our <a href=\"https:\/\/theitlead.com\/blog\/user-access-review-checklist\/\">user access review checklist<\/a> is the place to start.<\/p>\n\n\n\n<h2 class=\"wp-block-heading\" id=\"how-often-to-run-access-reviews\">How often to run access reviews<\/h2>\n\n\n\n<p class=\"wp-block-paragraph\">How often to run access reviews depends on the rules you answer to, not on the tool. PCI DSS v4.0 requirement 7.2.4 requires every user account and its privileges to be reviewed at least once every six months. HIPAA's minimum necessary standard doesn't set a recertification interval, so you define one in your own access policy. For SOC 2 and ISO 27001 we found no fixed number of days either, which means the auditor checks that you ran the review as often as your own policy says. Check the wording with your auditor before you promise anything.<\/p>\n\n\n\n<figure class=\"wp-block-table\"><table><thead><tr><th>Situation<\/th><th>Common interval in months<\/th><th>Why<\/th><\/tr><\/thead><tbody><tr><td>Systems in PCI DSS scope<\/td><td>At least every 6 months<\/td><td>PCI DSS v4.0 requirement 7.2.4<\/td><\/tr><tr><td>Finance, production and admin access<\/td><td>Quarterly<\/td><td>Highest impact if a leaver keeps access<\/td><\/tr><tr><td>Standard SaaS apps<\/td><td>Twice a year to yearly<\/td><td>Lower impact, higher volume<\/td><\/tr><tr><td>Contractors, guests and shared accounts<\/td><td>Quarterly<\/td><td>They leave without an HR event<\/td><\/tr><tr><td>Service accounts and tokens<\/td><td>Twice a year<\/td><td>They have no manager to notice them<\/td><\/tr><\/tbody><\/table><\/figure>\n\n\n\n<p class=\"wp-block-paragraph\">The quarterly and twice-a-year figures are common practice, not a rule from a standard. A tool that supports recurring campaigns makes any of them cheap, because the next round starts without anyone remembering it.<\/p>\n\n\n\n<h2 class=\"wp-block-heading\" id=\"what-to-look-for-in-access-review-software\">What to look for in access review software<\/h2>\n\n\n\n<p class=\"wp-block-paragraph\">Netwrix's own guide lists integration breadth, reviewer context, closed-loop removal and compliance evidence as the capabilities that matter. We agree with the list and add one more for small teams: what you have to buy first. The table shows the question to ask each vendor.<\/p>\n\n\n\n<figure class=\"wp-block-table\"><table><thead><tr><th>Access review software criterion<\/th><th>Vendor question<\/th><th>Reason<\/th><\/tr><\/thead><tbody><tr><td>Coverage<\/td><td>Which of my apps and groups can it read, and what happens to an app with no connector?<\/td><td>Reviews limited to your identity provider miss everything outside single sign-on<\/td><\/tr><tr><td>Reviewer context<\/td><td>Does the reviewer see last sign-in, peers or a recommendation?<\/td><td>Without it, reviewers approve everything<\/td><\/tr><tr><td>Removal<\/td><td>Does a denial remove access, create a ticket or only record the answer?<\/td><td>Auditors test that access was actually removed<\/td><\/tr><tr><td>Evidence<\/td><td>What leaves the tool: a report, CSV, checksums, decisions with timestamps?<\/td><td>This is the part you hand over in an audit<\/td><\/tr><tr><td>What you buy first<\/td><td>Which license or platform must I already own?<\/td><td>Governance is often an add-on, and every user in scope has to be licensed<\/td><\/tr><\/tbody><\/table><\/figure>\n\n\n\n<h2 class=\"wp-block-heading\" id=\"how-we-chose-these-tools\">How we chose these tools<\/h2>\n\n\n\n<p class=\"wp-block-paragraph\">We picked tools a small IT team can realistically buy or already owns part of, then checked six things for each: where its reviews can reach, who reviews, how a denial is carried out, what evidence leaves the tool, what the price counts and what you must own first. Each entry follows one quarterly review of one finance app from scope to report, so you can compare the steps and see where a tool stops.<\/p>\n\n\n\n<p class=\"wp-block-paragraph\">Prices and docs were read on vendor pages on November 2, 2026. Ratings come from G2 pages we opened that day. Where a rating or a review theme couldn't be read, the entry says so instead of filling the gap. No vendor paid for a place here, and we don't link to vendor sites.<\/p>\n\n\n\n<p class=\"wp-block-paragraph\">Not covered here: Netwrix Identity Manager, SailPoint, Saviynt, YouAttest, Pathlock and Console. Netwrix ranks its own product first in the guide at the top of Google, so we didn't use its list as ours. Our <a href=\"https:\/\/theitlead.com\/blog\/sailpoint-vs-saviynt\/\">SailPoint vs Saviynt comparison<\/a> covers the two large suites.<\/p>\n\n\n\n<h2 class=\"wp-block-heading\" id=\"review-modules-inside-identity-platforms\">Review modules inside identity platforms<\/h2>\n\n\n\n<p class=\"wp-block-paragraph\">If your identity platform already holds your people and apps, its governance module is the shortest path to a review. The catch in both entries below is the same: the review only sees what the platform manages, however good the campaign screen looks.<\/p>\n\n\n\n<section class=\"ok-card ok-wide\" aria-labelledby=\"microsoft-entra-id-governance\"><header class=\"ok-card__head\"><span class=\"ok-fav ok-fav--md\"><img src=\"\/blog\/wp-content\/uploads\/opskit\/fav\/entra-id-governance.png\" alt=\"\" width=\"24\" height=\"24\" loading=\"lazy\" decoding=\"async\"><\/span><div class=\"ok-card__title\"><h3 class=\"wp-block-heading\" id=\"microsoft-entra-id-governance\">Microsoft Entra ID Governance<\/h3><p class=\"ok-card__sub\">Best if your people and apps already live in Microsoft Entra<\/p><\/div><span class=\"ok-job\">Review module inside an identity platform<\/span><span class=\"ok-rate\"><span class=\"ok-stars\" aria-hidden=\"true\">\u2605\u2605\u2605\u2605\u2606<\/span> 4.6<span class=\"ok-muted\"> \u00b7 5 G2 reviews<\/span><\/span><\/header><div class=\"ok-card__body\"><div class=\"ok-card__main\"><p class=\"ok-lede\">Entra ID Governance suits a Microsoft 365 shop that wants quarterly reviews of group membership and Entra-connected apps inside the admin center it already uses.<\/p><p><strong>One review, start to finish.<\/strong> An admin with the Identity Governance Administrator role opens ID Governance, then Access Reviews, then New access review, and picks Teams and Groups or Applications. Selecting several groups or apps creates one separate review per group or app. Reviewers can be group owners, selected people, the managers of the people under review or the users themselves, and a fallback reviewer catches reviews with no valid owner. Reviews run for a set number of days and can repeat weekly, monthly, quarterly or yearly.<\/p><p>The reviewer opens a list with Approve, Deny, Don't know and Accept recommendations buttons. Decision helpers show whether someone signed in during the last 30 days, and a machine-learning helper compares a person's group membership with their peers. Reminders go out halfway through. You choose what happens when a reviewer doesn't answer: no change, remove access, approve access or take the recommendations. With auto apply on, denied people are removed from the group or app when the review ends. Multi-stage reviews allow up to three sequential reviewers, and the inactive-user scope reaches back up to 730 days.<\/p><p><strong>What it costs.<\/strong> Microsoft's pricing page lists Entra ID Governance at $7.00 per user per month, paid yearly, with a free trial. It's an add-on: Microsoft's licensing doc requires Entra ID P1 or P2, or Microsoft 365 E3 or E5, first, and every member user in scope or reviewing needs a license. Entra ID P2 at $10 includes basic access reviews. For 100 users the Governance add-on alone comes to $8,400 per year (100 x $7 x 12), on top of the base plan. Our <a href=\"https:\/\/theitlead.com\/blog\/microsoft-entra-id-pricing\/\">Entra ID pricing guide<\/a> explains the base tiers.<\/p><p><strong>Reviews and limits.<\/strong> G2 shows 4.6 out of 5 from 5 reviews for the Governance product, too few for G2 to summarize what users like or dislike. Reviews only cover Entra groups and apps that are integrated with Entra, and Entra roles and Azure roles are reviewed in Privileged Identity Management.<\/p><div class=\"ok-cs\"><div class=\"ok-cs__yes\"><strong class=\"ok-cs__h\">Choose it when<\/strong><ul><li>your people and apps already live in Microsoft Entra and you want reviews inside the admin center you use<\/li><li>you want denied access removed automatically from the group or app when the review ends<\/li><\/ul><\/div><div class=\"ok-cs__no\"><strong class=\"ok-cs__h\">Skip it when<\/strong><ul><li>most of your apps sit outside Entra: reviews only cover Entra groups and apps integrated with Entra<\/li><li>you hold no Entra ID P1 or P2 license yet: Governance is an add-on and every user in scope must be licensed<\/li><\/ul><\/div><\/div><dl class=\"ok-users\"><dt class=\"ok-k ok-k--p\">Users like<\/dt><dd>too few reviews for G2 to summarize<\/dd><dt class=\"ok-k ok-k--c\">Users dislike<\/dt><dd>too few reviews for G2 to summarize<\/dd><dd class=\"ok-src\">Source: <a href=\"https:\/\/www.g2.com\/products\/microsoft-entra-id-governance\/reviews\" rel=\"nofollow noopener noreferrer\" target=\"_blank\">G2<\/a>, 5 reviews<\/dd><\/dl><figure class=\"ok-shot\"><div class=\"ok-shot__bar\" aria-hidden=\"true\"><i><\/i><i><\/i><i><\/i><\/div><img src=\"https:\/\/theitlead.com\/blog\/wp-content\/uploads\/2026\/11\/arsw-entra.png\" alt=\"Microsoft Entra access review page titled Contoso Sales Group Review listing three members with Approve, Deny, Don&#x27;t know and Accept recommendations buttons and a recommendation column based on last sign-in.\" width=\"1394\" height=\"575\" loading=\"lazy\" decoding=\"async\"><figcaption>Reviewer view of a group review with recommendations, from Microsoft Learn<\/figcaption><\/figure><\/div><dl class=\"ok-card__side\"><div><dt>Starting price<\/dt><dd>$7.00 per user per month, paid yearly, as an add-on that needs Entra ID P1 or P2 (or Microsoft 365 E3 or E5) first; free trial offered. Entra ID P2 at $10 includes basic access reviews<\/dd><\/div><div><dt>Review scope<\/dt><dd>Groups, Teams, Entra-integrated apps<\/dd><\/div><div><dt>Reviewers<\/dt><dd>Managers, owners, self, selected users<\/dd><\/div><div><dt>Remediation<\/dt><dd>Auto-apply removes denied access<\/dd><\/div><div><dt>Licence<\/dt><dd>Add-on to Entra ID P1\/P2<\/dd><\/div><div><dt>Price<\/dt><dd>$7\/user\/mo, paid yearly, add-on<\/dd><\/div><div><dt>Prerequisite<\/dt><dd>Entra ID P1 or P2, or Microsoft 365 E3 or E5<\/dd><\/div><div><dt>Scope<\/dt><dd>Entra groups, Teams, Entra-integrated apps<\/dd><\/div><div><dt>Max stages<\/dt><dd>3<\/dd><\/div><div><dt>G2<\/dt><dd>4.6 from 5 reviews<\/dd><\/div><\/dl><\/div><\/section>\n\n\n\n<section class=\"ok-card ok-wide\" aria-labelledby=\"okta-identity-governance\"><header class=\"ok-card__head\"><span class=\"ok-fav ok-fav--md\"><img src=\"\/blog\/wp-content\/uploads\/opskit\/fav\/okta-identity-governance.png\" alt=\"\" width=\"24\" height=\"24\" loading=\"lazy\" decoding=\"async\"><\/span><div class=\"ok-card__title\"><h3 class=\"wp-block-heading\" id=\"okta-identity-governance\">Okta Identity Governance<\/h3><p class=\"ok-card__sub\">Best if Okta is already your identity provider<\/p><\/div><span class=\"ok-job\">Review module inside an identity platform<\/span><span class=\"ok-rate ok-muted\">No G2 rating<\/span><\/header><div class=\"ok-card__body\"><div class=\"ok-card__main\"><p class=\"ok-lede\">Okta Identity Governance fits a team that already signs in through Okta and wants certification campaigns next to its SSO and provisioning, with entitlements and service accounts in scope.<\/p><p><strong>One campaign, start to finish.<\/strong> A super admin or access certifications admin opens Identity Governance, then Access Certifications, then Certification campaigns, and creates a resource campaign. You pick an application, group, service account or collection, then narrow the people: everyone assigned, a custom scope written in Okta Expression Language, people with no recent activity or people with separation-of-duties conflicts. A reviewer can be the user, the manager, a group, an owner or a custom expression, and a fallback reviewer is required. A second review level is optional. Campaigns can run once or repeat, and they can also be created through the API or Okta Workflows.<\/p><p>Reviewers approve or revoke with a justification that you can make mandatory. Reminders go out at the midpoint, on the end day or a set number of days before, and an optional Slack notification exists. Remediation starts right after a decision, but auto-removal only works for access assigned to an individual app or group. Group-based access needs manual removal unless you switch on the optional auto-remove setting. An auditor reporting package and campaign summary reports come with it, and Okta's docs set limits of 500 active campaigns per org and 100,000 review items per campaign.<\/p><p><strong>What it costs.<\/strong> Okta publishes no price for Identity Governance. Its docs say Access Governance isn't available as a standalone add-on, and the add-on sits on top of an Okta Workforce Identity base that has a $1,500 annual contract minimum. Okta's public suites cost $6, $14 and $17 per user per month billed annually. The Essentials suite lists Access Governance in its feature bullets, but its comparison table cell for Identity Governance is blank and a footnote describes Identity Governance as an add-on, so the real bill is a quote. Our <a href=\"https:\/\/theitlead.com\/blog\/okta-pricing\/\">Okta pricing guide<\/a> covers the base plans.<\/p><p><strong>Reviews and limits.<\/strong> Okta Identity Governance has no G2 page of its own, so we show no rating. The 4.5 from 1,432 reviews that G2 shows for Okta is for the whole platform and says nothing about this module.<\/p><div class=\"ok-cs\"><div class=\"ok-cs__yes\"><strong class=\"ok-cs__h\">Choose it when<\/strong><ul><li>Okta is already your identity provider and you want certification campaigns next to your SSO and provisioning<\/li><li>you need campaigns that cover entitlements, admin roles and service accounts in Okta<\/li><\/ul><\/div><div class=\"ok-cs__no\"><strong class=\"ok-cs__h\">Skip it when<\/strong><ul><li>you are not on Okta: Identity Governance is an add-on to an Okta Workforce Identity base<\/li><li>you need a price before a sales call: none is published and Okta's own table is unclear about which suite includes it<\/li><\/ul><\/div><\/div><\/div><dl class=\"ok-card__side\"><div><dt>Starting price<\/dt><dd>No public price (quote only); sold as an add-on to Okta Workforce Identity, which has a $1,500 annual contract minimum<\/dd><\/div><div><dt>Campaign types<\/dt><dd>Resource and identity campaigns<\/dd><\/div><div><dt>Reviewers<\/dt><dd>User, manager, group, owner, custom<\/dd><\/div><div><dt>Active campaigns<\/dt><dd>500 per org (docs limit)<\/dd><\/div><div><dt>Licence<\/dt><dd>Add-on to Workforce Identity<\/dd><\/div><div><dt>Price<\/dt><dd>Quote only, add-on to Workforce Identity<\/dd><\/div><div><dt>Base minimum<\/dt><dd>$1,500 annual contract<\/dd><\/div><div><dt>Limits<\/dt><dd>500 active campaigns, 100,000 items per campaign<\/dd><\/div><div><dt>G2<\/dt><dd>No page for this module<\/dd><\/div><\/dl><\/div><\/section>\n\n\n\n<h2 class=\"wp-block-heading\" id=\"dedicated-identity-governance-for-lean-teams\">Dedicated identity governance for lean teams<\/h2>\n\n\n\n<p class=\"wp-block-paragraph\">ConductorOne and Lumos are built around reviews and lifecycle rather than adding them to a login product. Neither publishes a price, and both are bigger than a team of three really needs.<\/p>\n\n\n\n<section class=\"ok-card ok-wide\" aria-labelledby=\"conductorone-c1\"><header class=\"ok-card__head\"><span class=\"ok-fav ok-fav--md\"><img src=\"\/blog\/wp-content\/uploads\/opskit\/fav\/conductorone.png\" alt=\"\" width=\"24\" height=\"24\" loading=\"lazy\" decoding=\"async\"><\/span><div class=\"ok-card__title\"><h3 class=\"wp-block-heading\" id=\"conductorone-c1\">ConductorOne (C1)<\/h3><p class=\"ok-card__sub\">Best for campaigns that remove access through connectors<\/p><\/div><span class=\"ok-job\">Dedicated identity governance<\/span><span class=\"ok-rate\"><span class=\"ok-stars\" aria-hidden=\"true\">\u2605\u2605\u2605\u2605\u2605<\/span> 4.8<span class=\"ok-muted\"> \u00b7 13 G2 reviews<\/span><\/span><\/header><div class=\"ok-card__body\"><div class=\"ok-card__main\"><p class=\"ok-lede\">ConductorOne, now branded C1, suits a team that wants a campaign to end with access actually removed, not a list of names to chase.<\/p><p><strong>One campaign, start to finish.<\/strong> An admin opens Governance, then Campaigns, then New campaign, and sets the type, a due date, the scope type and the owners. Scope can be by entitlements, by access conflicts, by inheritance or by users, which is in early access, and the type can't be changed later. You then choose apps and entitlements, narrow by department, manager or whether a grant is unused, check that the data sources synced and stage the campaign. Staging takes a snapshot and locks the scope. Reviewers are routed by manager, app owner, entitlement owner or account owner, with a fallback and delegates.<\/p><p>In the reviewer view, shown below, each app has a progress bar and approve and deny buttons per account. AI recommendations suggest 'Take a closer look' or 'Remove this access', and an Insights tab shows how many others hold the same access. A denial is removed through the entitlement's deprovisioning method, which the review policy can run automatically, or it becomes a ticket in your ITSM tool for apps with no automation. Recurring campaigns run from a template with a schedule. Reports download as Excel with MD5 and SHA256 checksums.<\/p><p><strong>What it costs.<\/strong> The pricing page shows no USD price. It offers platform pricing by managed identities, with a slider from 100 to 20,000, or monthly usage-based Flex pricing metered in C1 Tokens. It states no free tier, trial or minimum. G2 lists the product as C1 at 4.8 out of 5 from 13 reviews, with ease of use, support and reliability as the praise tags and integration issues and missing features as the complaint tags.<\/p><div class=\"ok-cs\"><div class=\"ok-cs__yes\"><strong class=\"ok-cs__h\">Choose it when<\/strong><ul><li>you want campaigns that remove denied access through connectors instead of leaving a to-do list<\/li><li>you want recurring campaign templates and AI recommendations for reviewers<\/li><\/ul><\/div><div class=\"ok-cs__no\"><strong class=\"ok-cs__h\">Skip it when<\/strong><ul><li>you need a published price or a free tier: neither exists on the pricing page<\/li><li>your team is very small: the pricing slider starts at 100 managed identities and the campaign model is built for a governance program<\/li><\/ul><\/div><\/div><dl class=\"ok-users\"><dt class=\"ok-k ok-k--p\">Users like<\/dt><dd>ease of use, support and reliability, per G2's tags<\/dd><dt class=\"ok-k ok-k--c\">Users dislike<\/dt><dd>integration issues and missing features, per G2's tags<\/dd><dd class=\"ok-src\">Source: <a href=\"https:\/\/www.g2.com\/products\/c1-c1\/reviews\" rel=\"nofollow noopener noreferrer\" target=\"_blank\">G2<\/a>, 13 reviews<\/dd><\/dl><figure class=\"ok-shot\"><div class=\"ok-shot__bar\" aria-hidden=\"true\"><i><\/i><i><\/i><i><\/i><\/div><img src=\"https:\/\/theitlead.com\/blog\/wp-content\/uploads\/2026\/11\/arsw-conductorone-screenshot.png\" alt=\"ConductorOne campaign called Quarterly UAR showing 54 of 175 reviews decided, a list of apps on the left and Slack accounts with approve and deny buttons, last login and insights columns.\" width=\"2000\" height=\"966\" loading=\"lazy\" decoding=\"async\"><figcaption>Quarterly user access review in C1 with per-account approve and deny, from C1's docs<\/figcaption><\/figure><\/div><dl class=\"ok-card__side\"><div><dt>Starting price<\/dt><dd>Quote only; the pricing page offers platform pricing by managed identities (slider from 100 to 20,000) or monthly usage-based Flex pricing in C1 Tokens<\/dd><\/div><div><dt>Scope types<\/dt><dd>Entitlements, access conflicts, inheritance, users<\/dd><\/div><div><dt>Evidence<\/dt><dd>Excel with checksums<\/dd><\/div><div><dt>Recurrence<\/dt><dd>Campaign templates<\/dd><\/div><div><dt>Rebrand<\/dt><dd>ConductorOne is now C1<\/dd><\/div><div><dt>Price<\/dt><dd>Quote only<\/dd><\/div><div><dt>Reviewers<\/dt><dd>Manager, app owner, entitlement owner, account owner<\/dd><\/div><div><dt>G2<\/dt><dd>4.8 from 13 reviews (listed as C1)<\/dd><\/div><\/dl><\/div><\/section>\n\n\n\n<section class=\"ok-card ok-wide\" aria-labelledby=\"lumos\"><header class=\"ok-card__head\"><span class=\"ok-fav ok-fav--md\"><img src=\"\/blog\/wp-content\/uploads\/opskit\/fav\/lumos.png\" alt=\"\" width=\"24\" height=\"24\" loading=\"lazy\" decoding=\"async\"><\/span><div class=\"ok-card__title\"><h3 class=\"wp-block-heading\" id=\"lumos\">Lumos<\/h3><p class=\"ok-card__sub\">Best when non-human identities must sit in the same review<\/p><\/div><span class=\"ok-job\">Dedicated identity governance<\/span><span class=\"ok-rate\"><span class=\"ok-stars\" aria-hidden=\"true\">\u2605\u2605\u2605\u2605\u2606<\/span> 4.7<span class=\"ok-muted\"> \u00b7 69 G2 reviews<\/span><\/span><\/header><div class=\"ok-card__body\"><div class=\"ok-card__main\"><p class=\"ok-lede\">Lumos fits a team that wants service accounts and other non-human identities reviewed in the same view as people, with an AI first pass on the easy calls.<\/p><p><strong>One campaign, start to finish.<\/strong> We could read the reviewer side only, because Lumos's admin documentation sits behind a login. The reviewer opens a notification or signs in through SSO, clicks Continue Review for an app and chooses a Permissions review, which covers roles and groups, or an Accounts review, which covers app access. Each line can be rejected, modified or approved, the rest can be bulk-approved, and the reviewer adds notes for the auditor. Admin privileges and unmatched accounts are flagged for a closer look.<\/p><p>Lumos says its reviews cover humans, service accounts and other non-human identities in one view, that rejected access is deprovisioned across more than 100 integrations and that an immutable audit trail is kept. That's vendor wording we couldn't test. It also describes an AI agent that does a first pass, sorting low-risk items from anomalies by role, department, last activity, peer group and separation of duties.<\/p><p><strong>What it costs.<\/strong> The pricing page lists no plans or prices. It offers a demo and a free identity assessment, so we treat it as demo-led. Third-party sites quote conflicting figures, and we don't use them. G2 shows 4.7 out of 5 from 69 reviews. The praise tags are ease of use, time savings and automation, and the complaint tags are integration issues, limited integrations and complex setup.<\/p><div class=\"ok-cs\"><div class=\"ok-cs__yes\"><strong class=\"ok-cs__h\">Choose it when<\/strong><ul><li>service accounts and other non-human identities need to sit in the same review as people<\/li><li>you want an AI first pass on reviews with anomalies flagged<\/li><\/ul><\/div><div class=\"ok-cs__no\"><strong class=\"ok-cs__h\">Skip it when<\/strong><ul><li>you need a price before a demo: the pricing page shows none<\/li><li>you want to read how an admin sets up a campaign first: its admin docs sit behind a login<\/li><\/ul><\/div><\/div><dl class=\"ok-users\"><dt class=\"ok-k ok-k--p\">Users like<\/dt><dd>ease of use, time savings and automation, per G2's tags<\/dd><dt class=\"ok-k ok-k--c\">Users dislike<\/dt><dd>integration issues, limited integrations and complex setup, per G2's tags<\/dd><dd class=\"ok-src\">Source: <a href=\"https:\/\/www.g2.com\/products\/lumos\/reviews\" rel=\"nofollow noopener noreferrer\" target=\"_blank\">G2<\/a>, 69 reviews<\/dd><\/dl><figure class=\"ok-shot\"><div class=\"ok-shot__bar\" aria-hidden=\"true\"><i><\/i><i><\/i><i><\/i><\/div><img src=\"https:\/\/theitlead.com\/blog\/wp-content\/uploads\/2026\/11\/arsw-lumos-screenshot.png\" alt=\"Lumos reviewer view of AWS permissions with Unreviewed, Reviewed and All Permissions tabs and a table of employees, account identifiers, permissions, assignee and approve or reject buttons.\" width=\"2512\" height=\"1268\" loading=\"lazy\" decoding=\"async\"><figcaption>Reviewer view of AWS permissions with approve and reject per line, from Lumos's help center<\/figcaption><\/figure><\/div><dl class=\"ok-card__side\"><div><dt>Starting price<\/dt><dd>No price published; the pricing page offers a demo and a free identity assessment<\/dd><\/div><div><dt>Scope<\/dt><dd>Humans, service accounts, non-human identities<\/dd><\/div><div><dt>Removal<\/dt><dd>Through 100+ integrations (vendor claim)<\/dd><\/div><div><dt>AI<\/dt><dd>First-pass agent<\/dd><\/div><div><dt>Admin docs<\/dt><dd>Behind a login<\/dd><\/div><div><dt>Price<\/dt><dd>Not published, demo-led<\/dd><\/div><div><dt>G2<\/dt><dd>4.7 from 69 reviews<\/dd><\/div><\/dl><\/div><\/section>\n\n\n\n<h2 class=\"wp-block-heading\" id=\"saas-management-and-compliance-tools-with-access-reviews\">SaaS management and compliance tools with access reviews<\/h2>\n\n\n\n<p class=\"wp-block-paragraph\">In Zluri, Torii, Vanta and CoreView, access reviews are one feature of a bigger product. That's cheaper in attention if you already own the product, and really expensive if you buy it only for this.<\/p>\n\n\n\n<section class=\"ok-card ok-wide\" aria-labelledby=\"zluri\"><header class=\"ok-card__head\"><span class=\"ok-fav ok-fav--md\"><img src=\"\/blog\/wp-content\/uploads\/opskit\/fav\/zluri.png\" alt=\"\" width=\"24\" height=\"24\" loading=\"lazy\" decoding=\"async\"><\/span><div class=\"ok-card__title\"><h3 class=\"wp-block-heading\" id=\"zluri\">Zluri<\/h3><p class=\"ok-card__sub\">Best when service accounts and groups need the same review as apps<\/p><\/div><span class=\"ok-job\">SaaS management and identity governance<\/span><span class=\"ok-rate\"><span class=\"ok-stars\" aria-hidden=\"true\">\u2605\u2605\u2605\u2605\u2606<\/span> 4.6<span class=\"ok-muted\"> \u00b7 177 G2 reviews<\/span><\/span><\/header><div class=\"ok-card__body\"><div class=\"ok-card__main\"><p class=\"ok-lede\">Zluri suits a team that already wants SaaS discovery and license reclamation and needs access certifications that reach service and API accounts.<\/p><p><strong>One certification, start to finish.<\/strong> In Access Reviews you click Create New Certification and walk a three-step wizard: details, setup and completion, with drafts saved at any step. The certification owner must hold an Owner, Admin or IT Admin role. The entity type is Applications, Groups or Users, and a Known Accounts review can filter by account type, including Service, API, Group, Employee and Shared, and by privileged role. Default reviewers are the app owner or the reporting manager for apps, and the reporting manager or department head for groups, with multi-level reviews and per-entity overrides.<\/p><p>A recurring toggle repeats the certification, and reminders go to reviewers before the end date and to the owner before the remediation date. Zluri describes closed-loop remediation: deprovisioning playbooks run through API integrations when the review concludes, or they can be turned into a manual task. A PDF report lists the apps in scope, the reviewer actions and timestamps. Zluri cites 300+ connectors, a platform-wide number that isn't specific to reviews.<\/p><p><strong>What it costs.<\/strong> Zluri has no public price. Vendr, a buying platform, shows a median contract of about $36,820 per year for the whole platform, with a range from $14,045 to $75,900, and that's secondary data. Infotech announced on October 14, 2026 that it acquired Zluri, which continues as a standalone division. G2 shows 4.6 out of 5 from 177 reviews. Ease of use and automation draw 12 mentions each, and limited integrations lead the complaints with 8.<\/p><div class=\"ok-cs\"><div class=\"ok-cs__yes\"><strong class=\"ok-cs__h\">Choose it when<\/strong><ul><li>you want the widest discovery sources (SSO, finance, MDM, CASB, browser and desktop agents) and automatic license reclamation on a schedule<\/li><li>you also need access reviews and a service account and API token inventory in the same tool<\/li><\/ul><\/div><div class=\"ok-cs__no\"><strong class=\"ok-cs__h\">Skip it when<\/strong><ul><li>you want to see a price before talking to sales: there is no pricing page<\/li><li>you need highly customized workflows or hourly data: reviewers cite limited customization and a 24 hour refresh<\/li><\/ul><\/div><\/div><dl class=\"ok-users\"><dt class=\"ok-k ok-k--p\">Users like<\/dt><dd>ease of use (12 mentions) and automation (12)<\/dd><dt class=\"ok-k ok-k--c\">Users dislike<\/dt><dd>limited integrations (8) and limited features (7)<\/dd><dd class=\"ok-src\">Source: <a href=\"https:\/\/www.g2.com\/products\/zluri\/reviews\" rel=\"nofollow noopener noreferrer\" target=\"_blank\">G2<\/a>, 177 reviews<\/dd><\/dl><figure class=\"ok-shot\"><div class=\"ok-shot__bar\" aria-hidden=\"true\"><i><\/i><i><\/i><i><\/i><\/div><img src=\"https:\/\/theitlead.com\/blog\/wp-content\/uploads\/2026\/11\/arsw-zluri-screenshot.png\" alt=\"Zluri Create Certification wizard, step one Provide Details, with fields for certification name, owner, description and entity type inside the Identity Governance and Administration menu.\" width=\"2000\" height=\"1079\" loading=\"lazy\" decoding=\"async\"><figcaption>Create Certification wizard, step one, from Zluri's help center<\/figcaption><\/figure><\/div><dl class=\"ok-card__side\"><div><dt>Starting price<\/dt><dd>No public pricing, demo request only<\/dd><\/div><div><dt>Discovery<\/dt><dd>SSO, finance, MDM, CASB, agents<\/dd><\/div><div><dt>Non-human IDs<\/dt><dd>Service accounts, keys, tokens, bots<\/dd><\/div><div><dt>Owner<\/dt><dd>Infotech (acquired October 2026)<\/dd><\/div><div><dt>Price<\/dt><dd>Quote only<\/dd><\/div><div><dt>Entity types<\/dt><dd>Applications, groups, users<\/dd><\/div><div><dt>Account types<\/dt><dd>Service, API, group, employee, shared<\/dd><\/div><div><dt>Evidence<\/dt><dd>PDF report<\/dd><\/div><div><dt>G2<\/dt><dd>4.6 from 177 reviews<\/dd><\/div><\/dl><\/div><\/section>\n\n\n\n<section class=\"ok-card ok-wide\" aria-labelledby=\"torii\"><header class=\"ok-card__head\"><span class=\"ok-fav ok-fav--md\"><img src=\"\/blog\/wp-content\/uploads\/opskit\/fav\/torii-access.png\" alt=\"\" width=\"24\" height=\"24\" loading=\"lazy\" decoding=\"async\"><\/span><div class=\"ok-card__title\"><h3 class=\"wp-block-heading\" id=\"torii\">Torii<\/h3><p class=\"ok-card__sub\">Best when app owners should answer, even for apps with no integration<\/p><\/div><span class=\"ok-job\">SaaS management with access reviews<\/span><span class=\"ok-rate\"><span class=\"ok-stars\" aria-hidden=\"true\">\u2605\u2605\u2605\u2605\u2606<\/span> 4.5<span class=\"ok-muted\"> \u00b7 325 G2 reviews<\/span><\/span><\/header><div class=\"ok-card__body\"><div class=\"ok-card__main\"><p class=\"ok-lede\">Torii suits a team that wants app owners to review their own apps, including apps Torii can't connect to, and that already has budget for a SaaS management platform.<\/p><p><strong>One campaign, start to finish.<\/strong> In Access Reviews you create a campaign in a wizard. Step one picks apps with live filters, for example sanctioned apps with more than 10 users. Step two sets the user scope: everyone by default, or privileged users such as those whose role contains Admin. Step three assigns reviewers, either named people or a dynamic field such as App Owner, plus remediation owners. For an app that isn't integrated, the reviewer uploads a user file. Torii says human and non-human identities, such as bots and service accounts, run through the same review flow.<\/p><p>Reviewers approve or reject with comments, using usage data and Torii recommendations. Rejected access is then handled by a remediation owner, usually IT, who removes or downgrades it in Torii or in the app, verifies the removal and submits the final report. A campaign's deadline is used for monitoring only, so it doesn't escalate. Reports of finished campaigns can be exported.<\/p><p><strong>What it costs.<\/strong> Torii's support doc says access reviews are available on the Enterprise plan and the Torii Identity module, which matters for a small team. It publishes no price, and Vendr shows a median of about $32,000 per year for the platform, or $15,000 to $35,000 for companies with 100 to 500 employees. Freshworks announced on October 12, 2026 that it signed an agreement to acquire Torii. G2 shows 4.5 out of 5 from 325 reviews, with ease of use at 31 mentions and missing features at 16.<\/p><div class=\"ok-cs\"><div class=\"ok-cs__yes\"><strong class=\"ok-cs__h\">Choose it when<\/strong><ul><li>you want app owners, not IT, to answer for each app and a campaign that also covers apps with no integration<\/li><li>you want service accounts and bots in the same review flow as people<\/li><\/ul><\/div><div class=\"ok-cs__no\"><strong class=\"ok-cs__h\">Skip it when<\/strong><ul><li>you need access reviews on a lower plan: the support doc limits them to Enterprise or the Torii Identity module<\/li><li>you want removal to happen automatically: remediation is owner-driven<\/li><\/ul><\/div><\/div><dl class=\"ok-users\"><dt class=\"ok-k ok-k--p\">Users like<\/dt><dd>ease of use (31 mentions) and app integration (20)<\/dd><dt class=\"ok-k ok-k--c\">Users dislike<\/dt><dd>missing features (16) and poor reporting (7)<\/dd><dd class=\"ok-src\">Source: <a href=\"https:\/\/www.g2.com\/products\/torii\/reviews\" rel=\"nofollow noopener noreferrer\" target=\"_blank\">G2<\/a>, 325 reviews<\/dd><\/dl><figure class=\"ok-shot\"><div class=\"ok-shot__bar\" aria-hidden=\"true\"><i><\/i><i><\/i><i><\/i><\/div><img src=\"https:\/\/theitlead.com\/blog\/wp-content\/uploads\/2026\/11\/arsw-torii-screenshot.png\" alt=\"Torii user access review for Zendesk showing 30 of 44 reviews done, users with usage, status and recommendation columns, a service account row and an Approve, Reject or Downgrade menu.\" width=\"700\" height=\"700\" loading=\"lazy\" decoding=\"async\"><figcaption>Zendesk access review with usage, recommendation and a service account row, from Torii's product page<\/figcaption><\/figure><\/div><dl class=\"ok-card__side\"><div><dt>Starting price<\/dt><dd>Quote only; the support doc says access reviews are available on the Enterprise plan and the Torii Identity module; Vendr buyer data shows a median of about $32,000 per year for the platform<\/dd><\/div><div><dt>Plan gate<\/dt><dd>Enterprise plan or Torii Identity module<\/dd><\/div><div><dt>Remediation<\/dt><dd>Owner-driven<\/dd><\/div><div><dt>Non-human IDs<\/dt><dd>Same review flow<\/dd><\/div><div><dt>Owner<\/dt><dd>Freshworks deal announced October 12, 2026<\/dd><\/div><div><dt>Price<\/dt><dd>Quote only<\/dd><\/div><div><dt>Non-integrated apps<\/dt><dd>Reviewer uploads a user file<\/dd><\/div><div><dt>G2<\/dt><dd>4.5 from 325 reviews<\/dd><\/div><\/dl><\/div><\/section>\n\n\n\n<section class=\"ok-card ok-wide\" aria-labelledby=\"vanta\"><header class=\"ok-card__head\"><span class=\"ok-fav ok-fav--md\"><img src=\"\/blog\/wp-content\/uploads\/opskit\/fav\/vanta-access.png\" alt=\"\" width=\"24\" height=\"24\" loading=\"lazy\" decoding=\"async\"><\/span><div class=\"ok-card__title\"><h3 class=\"wp-block-heading\" id=\"vanta\">Vanta<\/h3><p class=\"ok-card__sub\">Best if SOC 2 or ISO 27001 evidence is the reason you review<\/p><\/div><span class=\"ok-job\">Compliance automation with access reviews<\/span><span class=\"ok-rate\"><span class=\"ok-stars\" aria-hidden=\"true\">\u2605\u2605\u2605\u2605\u2606<\/span> 4.5<span class=\"ok-muted\"> \u00b7 2,897 G2 reviews<\/span><\/span><\/header><div class=\"ok-card__body\"><div class=\"ok-card__main\"><p class=\"ok-lede\">Vanta suits a team that already buys it for SOC 2 or ISO 27001 and wants reviews that feed the same evidence, as long as someone else removes the access.<\/p><p><strong>One review, start to finish.<\/strong> In Access, then Reviews, you create a draft, name it and select the in-scope apps. A Synced column shows which apps pulled data automatically and which need an upload. For an app with no integration you upload a CSV, or a screenshot or PDF that Vanta's image parser turns into an access file. When every app has data, you start the review and reviewers get a notification. They open an app, approve or deny each account and add notes, and every account needs an owner before the review can be submitted. After the start you can't add apps or re-upload files. Schedules, due-date windows and reminders are set in Settings, then Personnel, then Access reviews.<\/p><p>This is where Vanta stops. A denial starts a remediation flow, but Vanta's help center says it can't currently write any changes to your applications. Someone has to remove the access in the app and document it. Completed reviews fill the access review test page that holds your audit evidence, and a review can be exported.<\/p><p><strong>What it costs.<\/strong> Vanta publishes no USD price, only four plans (Essentials, Plus, Professional, Enterprise) and a request for a demo. Access Management starts at the Plus plan, and the help center says it may need an upgrade or add-on. A free trial of about 5 to 7 days and startup pricing exist. On G2 it holds 4.5 out of 5 from 2,897 reviews. Ease of use has 798 mentions and compliance 606. The leading complaints are integration problems (207), pricing for small businesses (178) and cost (173).<\/p><div class=\"ok-cs\"><div class=\"ok-cs__yes\"><strong class=\"ok-cs__h\">Choose it when<\/strong><ul><li>you already buy Vanta for SOC 2 or ISO 27001 and want reviews tied to the same evidence<\/li><li>you need reviews of apps that have no integration, using a CSV or screenshot upload<\/li><\/ul><\/div><div class=\"ok-cs__no\"><strong class=\"ok-cs__h\">Skip it when<\/strong><ul><li>you want denied access removed for you: the help center says Vanta cannot write changes to your applications<\/li><li>you only need access reviews: they are one feature of a compliance suite that reviewers on G2 call expensive<\/li><\/ul><\/div><\/div><dl class=\"ok-users\"><dt class=\"ok-k ok-k--p\">Users like<\/dt><dd>ease of use (798 mentions) and compliance (606)<\/dd><dt class=\"ok-k ok-k--c\">Users dislike<\/dt><dd>integration problems (207), pricing (178) and cost (173)<\/dd><dd class=\"ok-src\">Source: <a href=\"https:\/\/www.g2.com\/products\/vanta\/reviews\" rel=\"nofollow noopener noreferrer\" target=\"_blank\">G2<\/a>, 2,897 reviews<\/dd><\/dl><figure class=\"ok-shot\"><div class=\"ok-shot__bar\" aria-hidden=\"true\"><i><\/i><i><\/i><i><\/i><\/div><img src=\"https:\/\/theitlead.com\/blog\/wp-content\/uploads\/2026\/11\/arsw-vanta-access-screenshot.png\" alt=\"Vanta access review titled High-risk systems quarterly review with progress for 7 applications, an AI recommendations panel and a table of apps such as AWS, Cloudflare and Google Workspace with synced data and reviewer.\" width=\"1400\" height=\"1026\" loading=\"lazy\" decoding=\"async\"><figcaption>Quarterly review with progress, AI recommendations and an app list, from Vanta's help center<\/figcaption><\/figure><\/div><dl class=\"ok-card__side\"><div><dt>Starting price<\/dt><dd>Quote only; Access Management starts at the Plus plan and may need an upgrade or add-on per the help center; free trial of about 5 to 7 days<\/dd><\/div><div><dt>Plan<\/dt><dd>Plus and above<\/dd><\/div><div><dt>Remediation<\/dt><dd>Tracks a denial, doesn't revoke<\/dd><\/div><div><dt>Non-integrated apps<\/dt><dd>CSV, screenshot or PDF upload<\/dd><\/div><div><dt>Evidence<\/dt><dd>Feeds the audit evidence test page<\/dd><\/div><div><dt>Price<\/dt><dd>Quote only, Plus plan and above<\/dd><\/div><div><dt>G2<\/dt><dd>4.5 from 2,897 reviews<\/dd><\/div><\/dl><\/div><\/section>\n\n\n\n<section class=\"ok-card ok-wide\" aria-labelledby=\"coreview\"><header class=\"ok-card__head\"><span class=\"ok-fav ok-fav--md\"><img src=\"\/blog\/wp-content\/uploads\/opskit\/fav\/coreview.png\" alt=\"\" width=\"24\" height=\"24\" loading=\"lazy\" decoding=\"async\"><\/span><div class=\"ok-card__title\"><h3 class=\"wp-block-heading\" id=\"coreview\">CoreView<\/h3><p class=\"ok-card__sub\">Best for a Microsoft 365 tenant and nothing else<\/p><\/div><span class=\"ok-job\">Microsoft 365 governance<\/span><span class=\"ok-rate\"><span class=\"ok-stars\" aria-hidden=\"true\">\u2605\u2605\u2605\u2605\u2606<\/span> 4.6<span class=\"ok-muted\"> \u00b7 119 G2 reviews<\/span><\/span><\/header><div class=\"ok-card__body\"><div class=\"ok-card__main\"><p class=\"ok-lede\">CoreView suits a Microsoft 365 shop that needs repeat reviews of Teams, SharePoint, OneDrive, guests and mailbox permissions from ready templates.<\/p><p><strong>One review, start to finish.<\/strong> In Reviews, then Access Review, you create a review from a template: Teams group members, security, distribution or Microsoft 365 group members, guest users, SharePoint site members, OneDrive owners or mailbox permissions. You set a title, tags and a High, Medium or Low priority, then a start date, which can't be the same day, and a due date. A periodic setting repeats the review every set number of days, for example 90. Reviewers are the resource owners, custom email addresses or tenant admins, with a backup when no owner exists, and reviewers without a CoreView account get a temporary restricted one.<\/p><p>Reviewers approve, modify or revoke each person's access, and the changes stay pending until the review is finalized. The docs we read don't say whether finalizing applies the changes in Microsoft 365, so ask. Reminders go out a set number of days before the due date, and all decisions can be exported as CSV for an audit.<\/p><p><strong>What it costs.<\/strong> CoreView prices by the number of licensed identities and gives no figure, with no minimum or trial stated. On G2 it holds 4.6 out of 5 from 119 reviews. Automation draws 12 mentions, ease of use 11 and reporting 7. The complaints are a steep learning curve (6), navigation (5) and limited features (4).<\/p><div class=\"ok-cs\"><div class=\"ok-cs__yes\"><strong class=\"ok-cs__h\">Choose it when<\/strong><ul><li>your estate is Microsoft 365 and you need reviews of Teams, SharePoint, OneDrive and mailbox permissions<\/li><li>you want reviews by resource owners from templates, with periodic repeats<\/li><\/ul><\/div><div class=\"ok-cs__no\"><strong class=\"ok-cs__h\">Skip it when<\/strong><ul><li>you need to review non-Microsoft SaaS apps: scope is Microsoft 365<\/li><li>you need to know the price first: it is per licensed identity and quote only<\/li><\/ul><\/div><\/div><dl class=\"ok-users\"><dt class=\"ok-k ok-k--p\">Users like<\/dt><dd>automation, ease of use and reporting, per G2's counts<\/dd><dt class=\"ok-k ok-k--c\">Users dislike<\/dt><dd>a steep learning curve and navigation, per G2's counts<\/dd><dd class=\"ok-src\">Source: <a href=\"https:\/\/www.g2.com\/products\/coreview\/reviews\" rel=\"nofollow noopener noreferrer\" target=\"_blank\">G2<\/a>, 119 reviews<\/dd><\/dl><figure class=\"ok-shot\"><div class=\"ok-shot__bar\" aria-hidden=\"true\"><i><\/i><i><\/i><i><\/i><\/div><img src=\"https:\/\/theitlead.com\/blog\/wp-content\/uploads\/2026\/11\/arsw-coreview-screenshot.png\" alt=\"CoreView Access Review page with a Create review from template panel offering Teams group members, security group members, guest users, SharePoint site members, OneDrive owners and mailbox permissions.\" width=\"1400\" height=\"729\" loading=\"lazy\" decoding=\"async\"><figcaption>Create review from template panel in CoreView's help center<\/figcaption><\/figure><\/div><dl class=\"ok-card__side\"><div><dt>Starting price<\/dt><dd>Quote only, per licensed Microsoft 365 identity; no minimum or trial stated<\/dd><\/div><div><dt>Scope<\/dt><dd>Teams, groups, SharePoint, OneDrive, guests, mailboxes<\/dd><\/div><div><dt>Recurrence<\/dt><dd>Periodic, set in days<\/dd><\/div><div><dt>Evidence<\/dt><dd>CSV export of decisions<\/dd><\/div><div><dt>Price basis<\/dt><dd>Per licensed identity<\/dd><\/div><div><dt>Price<\/dt><dd>Quote only, per licensed identity<\/dd><\/div><div><dt>G2<\/dt><dd>4.6 from 119 reviews<\/dd><\/div><\/dl><\/div><\/section>\n\n\n\n<h2 class=\"wp-block-heading\" id=\"what-the-licence-basis-costs-a-100-person-company\">What the licence basis costs a 100-person company<\/h2>\n\n\n\n<p class=\"wp-block-paragraph\">The licence basis differs a lot between these tools, and most of it is hidden. This table says what you can and can't budget for a 100-person company from public pages.<\/p>\n\n\n\n<figure class=\"wp-block-table\"><table><thead><tr><th>Tool<\/th><th>What the public page lets you budget<\/th><th>Annual USD figure for 100 users<\/th><\/tr><\/thead><tbody><tr><td>Entra ID Governance<\/td><td>$7 per user per month, paid yearly, plus the base Entra license<\/td><td>$8,400 for the add-on alone<\/td><\/tr><tr><td>Okta Identity Governance<\/td><td>Add-on price not published; base has a $1,500 annual minimum<\/td><td>Quote<\/td><\/tr><tr><td>ConductorOne (C1)<\/td><td>Platform price by managed identities, or usage-based Flex<\/td><td>Quote<\/td><\/tr><tr><td>Lumos<\/td><td>Demo-led, no price<\/td><td>Quote<\/td><\/tr><tr><td>Zluri<\/td><td>No price; Vendr median about $36,820 per year for the platform<\/td><td>Quote<\/td><\/tr><tr><td>Torii<\/td><td>No price; needs Enterprise or Torii Identity; Vendr $15,000 to $35,000 at 100 to 500 employees<\/td><td>Quote<\/td><\/tr><tr><td>Vanta<\/td><td>No price; Plus plan and above, may need an add-on<\/td><td>Quote<\/td><\/tr><tr><td>CoreView<\/td><td>Per licensed identity, no figure<\/td><td>Quote<\/td><\/tr><\/tbody><\/table><\/figure>\n\n\n\n<aside class=\"ok-callout ok-callout--watch\"><p><strong>What makes the bill grow<\/strong> The first license is rarely the whole price. Entra ID Governance needs Entra ID P1 or P2 under it, Okta's add-on needs a Workforce Identity base, Torii limits reviews to its Enterprise plan or the Torii Identity module, and Vanta starts access management at its Plus plan. Ask each vendor for the full price at your headcount with reviews, connectors for your actual apps and the report format your auditor wants.<\/p><\/aside>\n\n\n\n<h2 class=\"wp-block-heading\" id=\"a-quarterly-review-routine-for-one-admin\">A quarterly review routine for one admin<\/h2>\n\n\n\n<p class=\"wp-block-paragraph\">Any of these tools works better with a short routine. The tool collects and routes, and a person decides what the scope is, who is accountable and what happens when no one answers. The sequence assumes one admin and a finance app as the first scope.<\/p>\n\n\n\n<ol class=\"ok-timeline ok-wide\"><li><span class=\"ok-owner ok-owner--0\">IT admin<\/span><span class=\"ok-tl__task\">Pick the scope, such as the finance apps and admin groups, and list the accounts, including service accounts and guests <\/span><span class=\"ok-tl__when\">Week 1<\/span><\/li><li><span class=\"ok-owner ok-owner--1\">IT lead<\/span><span class=\"ok-tl__task\">Name a reviewer and a fallback reviewer for every app, and decide what happens to a review nobody answers <\/span><span class=\"ok-tl__when\">Week 1<\/span><\/li><li><span class=\"ok-owner ok-owner--0\">IT admin<\/span><span class=\"ok-tl__task\">Start the campaign with a due date two weeks out and send the kickoff notice <\/span><span class=\"ok-tl__when\">Week 2<\/span><\/li><li><span class=\"ok-owner ok-owner--2\">Reviewers<\/span><span class=\"ok-tl__task\">Approve or remove each account and write a short reason for anything unusual <\/span><span class=\"ok-tl__when\">Weeks 2 to 3<\/span><\/li><li><span class=\"ok-owner ok-owner--0\">IT admin<\/span><span class=\"ok-tl__task\">Carry out or confirm every removal, then check in the app that the account is gone <\/span><span class=\"ok-tl__when\">Week 4<\/span><\/li><li><span class=\"ok-owner ok-owner--1\">IT lead<\/span><span class=\"ok-tl__task\">Export the report, file it with the date and keep the open exceptions list for next quarter <\/span><span class=\"ok-tl__when\">Week 4<\/span><\/li><\/ol>\n\n\n\n<p class=\"wp-block-paragraph\">Run the first campaign on one app before you point the tool at everything. A review that nobody finishes, or a denial nobody carries out, gives you a report and no change in access, and that's exactly what an auditor tests for.<\/p>\n\n\n\n<h2 class=\"wp-block-heading\" id=\"service-accounts-and-non-human-identities-in-access-reviews\">Service accounts and non-human identities in access reviews<\/h2>\n\n\n\n<p class=\"wp-block-paragraph\">Most review campaigns list people. The accounts that cause trouble in an audit are often service accounts, API tokens and bots, because no manager notices them and no HR event retires them. Okta lists service accounts as a campaign resource, Zluri filters reviews by Service and API account types, Lumos and Torii say they put non-human identities in the same flow, and C1's own reviewer screenshot shows a service account row with an access decision next to it.<\/p>\n\n\n\n<p class=\"wp-block-paragraph\">All of that assumes the tool can already see the account. Before that, someone has to say who owns it and why it exists. Our <a href=\"https:\/\/theitlead.com\/blog\/service-account-access-review-template\/\">service account access review template<\/a> shows the fields to record, and the <a href=\"https:\/\/theitlead.com\/blog\/non-human-identity-lifecycle\/\">non-human identity lifecycle guide<\/a> covers the stages. The IT Lead covers the ownership step on its own, described below.<\/p>\n\n\n\n<aside class=\"ok-product ok-wide\" id=\"the-it-lead\"><span class=\"ok-fav ok-fav--md ok-fav--ours\"><img src=\"\/blog\/wp-content\/uploads\/opskit\/fav\/itl.svg\" alt=\"\" width=\"24\" height=\"24\" loading=\"lazy\" decoding=\"async\"><\/span><div><p class=\"ok-product__eyebrow\">What these tools don&#x27;t answer<\/p><p class=\"ok-product__head\">Know who owns every service account, and when it was last reviewed.<\/p><p>The IT Lead imports service accounts from CSV, nominates owners, collects their attestations and keeps a review trail an auditor can follow. Built for small IT teams and MSPs.<\/p><\/div><a class=\"ok-product__cta\" href=\"https:\/\/theitlead.com\/\">See how it works<\/a><\/aside>\n\n\n\n<h2 class=\"wp-block-heading\" id=\"which-tool-fits-which-team\">Which tool fits which team<\/h2>\n\n\n\n<ul class=\"ok-rows\"><li><span>Microsoft 365 with Entra ID P1 or P2 already paid for, and your apps are connected to Entra<\/span><strong class=\"ok-go\">Entra ID Governance, after checking the per-user add-on against your headcount<\/strong><\/li><li><span>Okta is your identity provider and you want campaigns next to SSO<\/span><strong class=\"ok-go\">Okta Identity Governance, after getting a quote with the base plan included<\/strong><\/li><li><span>You want a denied account removed through a connector or a ticket, and can budget a quote<\/span><strong class=\"ok-go\">ConductorOne (C1)<\/strong><\/li><li><span>Service and API accounts must be reviewed with people, and you want SaaS discovery too<\/span><strong class=\"ok-go\">Zluri<\/strong><\/li><li><span>App owners should answer for apps with no integration<\/span><strong class=\"ok-go\">Torii, with the Enterprise plan or Identity module<\/strong><\/li><li><span>SOC 2 or ISO 27001 is the reason, and your team removes access by hand<\/span><strong class=\"ok-go\">Vanta, if you already buy it for compliance<\/strong><\/li><li><span>Only Microsoft 365 matters: Teams, SharePoint, OneDrive and mailboxes<\/span><strong class=\"ok-go\">CoreView<\/strong><\/li><li><span>Non-human identities in the same review as people, with an AI first pass<\/span><strong class=\"ok-go\">Lumos, after a demo that shows the admin side<\/strong><\/li><\/ul>\n\n\n\n<p class=\"wp-block-paragraph\">Shortlist two tools and run both against the same finance app, including one account that should be removed, one guest and one service account. The tools look alike in a demo, but they behave differently when a reviewer says no. Check that the account is actually gone in the app, and ask for the report you would hand an auditor.<\/p>\n\n\n\n<h2 class=\"wp-block-heading\" id=\"access-review-software-faq\">Access review software FAQ<\/h2>\n\n\n<div id=\"rank-math-faq\" class=\"rank-math-block\">\n<div class=\"rank-math-list \">\n<div id=\"faq-question-1\" class=\"rank-math-list-item\">\n<h3 class=\"rank-math-question \">What is access review software?<\/h3>\n<div class=\"rank-math-answer \">\n\n<p>It's software that collects who has access to which systems, asks the right reviewer to approve or remove each person's access, records the answer and keeps the evidence for an audit. The stronger tools also remove the access when a reviewer says no, instead of leaving a to-do list.<\/p>\n\n<\/div>\n<\/div>\n<div id=\"faq-question-2\" class=\"rank-math-list-item\">\n<h3 class=\"rank-math-question \">How often should access reviews be done?<\/h3>\n<div class=\"rank-math-answer \">\n\n<p>PCI DSS v4.0 requirement 7.2.4 requires accounts and privileges to be reviewed at least every six months. Many teams review finance, production and admin access quarterly and other apps once or twice a year. SOC 2 and ISO 27001 leave the interval to your own policy, and the auditor checks that you followed it.<\/p>\n\n<\/div>\n<\/div>\n<div id=\"faq-question-3\" class=\"rank-math-list-item\">\n<h3 class=\"rank-math-question \">Is there free access review software?<\/h3>\n<div class=\"rank-math-answer \">\n\n<p>None of the eight tools lists a free plan. Entra ID Governance shows a free trial on Microsoft's pricing page and Vanta offers a trial of about 5 to 7 days. For a first review a spreadsheet and a checklist work, and our user access review checklist shows the steps.<\/p>\n\n<\/div>\n<\/div>\n<div id=\"faq-question-4\" class=\"rank-math-list-item\">\n<h3 class=\"rank-math-question \">What is the difference between an access review and access certification?<\/h3>\n<div class=\"rank-math-answer \">\n\n<p>Access review and access certification mean the same thing. Okta calls the process access certification and runs it as campaigns, and Entra, Vanta and CoreView say access reviews. Both ask a reviewer to confirm or remove access on a schedule.<\/p>\n\n<\/div>\n<\/div>\n<div id=\"faq-question-5\" class=\"rank-math-list-item\">\n<h3 class=\"rank-math-question \">Do I need an identity provider before buying access review software?<\/h3>\n<div class=\"rank-math-answer \">\n\n<p>You don't always need one first, but two of these tools do. Entra ID Governance and Okta Identity Governance need Entra or Okta underneath. ConductorOne, Lumos, Zluri, Torii and Vanta connect to your identity provider and apps, and Vanta and Torii also take uploaded files for apps with no connector.<\/p>\n\n<\/div>\n<\/div>\n<div id=\"faq-question-6\" class=\"rank-math-list-item\">\n<h3 class=\"rank-math-question \">Can access review software remove access automatically?<\/h3>\n<div class=\"rank-math-answer \">\n\n<p>Some access review tools can remove access automatically. Entra auto-apply removes denied people from groups and apps, ConductorOne runs deprovisioning from its review policy and Zluri runs playbooks when the review ends. Vanta's help center says it can't write changes to your apps, and Torii leaves removal to a remediation owner.<\/p>\n\n<\/div>\n<\/div>\n<div id=\"faq-question-7\" class=\"rank-math-list-item\">\n<h3 class=\"rank-math-question \">Can access reviews cover service accounts?<\/h3>\n<div class=\"rank-math-answer \">\n\n<p>Okta, Zluri, Lumos and Torii all describe service or non-human accounts in their reviews. The tool still needs to see the account, and someone has to know who owns it, so an ownership list comes first, which is why it's worth doing before any purchase.<\/p>\n\n<\/div>\n<\/div>\n<\/div>\n<\/div>\n\n\n<ul class=\"ok-related ok-wide\"><li><a href=\"\/blog\/user-access-review-checklist\/\"><span>Template<\/span>User access review checklist<\/a><\/li><li><a href=\"\/blog\/service-account-access-review-template\/\"><span>Template<\/span>Service account access review template<\/a><\/li><li><a href=\"\/blog\/identity-and-access-management-software\/\"><span>Guide<\/span>Best identity and access management software<\/a><\/li><li><a href=\"\/blog\/saas-management-software\/\"><span>Guide<\/span>Best SaaS management software<\/a><\/li><\/ul>\n","protected":false},"excerpt":{"rendered":"<p>Access review software compared for small IT teams: eight tools with prices, license needs, G2 ratings, how each removes access and who should skip it.<\/p>\n","protected":false},"author":1,"featured_media":286,"comment_status":"closed","ping_status":"open","sticky":false,"template":"","format":"standard","meta":{"footnotes":""},"categories":[2],"tags":[],"class_list":["post-285","post","type-post","status-publish","format-standard","has-post-thumbnail","hentry","category-software"],"_links":{"self":[{"href":"https:\/\/theitlead.com\/blog\/wp-json\/wp\/v2\/posts\/285","targetHints":{"allow":["GET"]}}],"collection":[{"href":"https:\/\/theitlead.com\/blog\/wp-json\/wp\/v2\/posts"}],"about":[{"href":"https:\/\/theitlead.com\/blog\/wp-json\/wp\/v2\/types\/post"}],"author":[{"embeddable":true,"href":"https:\/\/theitlead.com\/blog\/wp-json\/wp\/v2\/users\/1"}],"replies":[{"embeddable":true,"href":"https:\/\/theitlead.com\/blog\/wp-json\/wp\/v2\/comments?post=285"}],"version-history":[{"count":2,"href":"https:\/\/theitlead.com\/blog\/wp-json\/wp\/v2\/posts\/285\/revisions"}],"predecessor-version":[{"id":293,"href":"https:\/\/theitlead.com\/blog\/wp-json\/wp\/v2\/posts\/285\/revisions\/293"}],"wp:featuredmedia":[{"embeddable":true,"href":"https:\/\/theitlead.com\/blog\/wp-json\/wp\/v2\/media\/286"}],"wp:attachment":[{"href":"https:\/\/theitlead.com\/blog\/wp-json\/wp\/v2\/media?parent=285"}],"wp:term":[{"taxonomy":"category","embeddable":true,"href":"https:\/\/theitlead.com\/blog\/wp-json\/wp\/v2\/categories?post=285"},{"taxonomy":"post_tag","embeddable":true,"href":"https:\/\/theitlead.com\/blog\/wp-json\/wp\/v2\/tags?post=285"}],"curies":[{"name":"wp","href":"https:\/\/api.w.org\/{rel}","templated":true}]}}