Administrating Access Reviews

Access reviews give administrators and app owners a centralized, streamlined way to manage and verify account access. From the Access page within your 1Password SaaS Manager dashboard, you can create and launch reviews, track their progress in real time, and view all reviews at a glance or sort them by date or status. This provides comprehensive context for making informed access decisions. 

How much information is visible from the Access page depends on what user role you’re assigned. Administrators can view all information on the Access page, while reviewers may only see information tied to the particular apps they manage. See Completing assigned access reviews for more information. 

After reviewing account access, you can export your reviews to share with auditors or other stakeholders as needed.

The Access page also includes widgets for quick visibility of and navigation to Access requests and Access issues.

Create an access review

Access reviews begin with an automatic snapshot of app access. A draft state of the review is started once you begin to create your review, allowing you to customize settings before launch and make sure the needed criteria is selected to enroll applications in your review. Once an access review is created and applications are added to it, individual app reviews are generated within the access review. 

To create an Access review:

1. Navigate to the Access page within your SaaS Manager dashboard.
2. Under “Access reviews”, select New.
3. Within the “New access review” window, fill out the following fields:
   1. Name: enter a name for your review.
   2. Choose how to enroll applications: The default options are “Status” and “Manual selection”, or use custom fields to categorize applications for enrollment. Status allows you to choose applications based on the status set for them in your Applications settings. For example, “Managed”. If you select “Manual selection”, you can select apps to add in the final step.
   3. Reviewer: Choose the default app role responsible for reviewing their account's access. You can select a default role, or use custom fields to assign reviewers. This may assign multiple reviewers, if multiple users have the assigned role. You can optionally add or remove specific users as reviewers. Those users will be notified by email or slack that they’ve been assigned a review, depending on standard notification settings.
   4. Start date: Choose a date for the new access review to go into effect.
   5. Review due: Choose how long reviewers have before the review is due. Notifications and reminders will be sent for the review based on the selected timeframe.
   6. Frequency: Choose how often the review should be performed. For example, one-off or quarterly. A new snapshot of accounts is created each time the review is set to run.
4. Select Create to save a draft of your access review. The page for your access review will open.
5. If you chose to enroll applications manually, select Add app. Begin typing to search for a specific application, or scroll through the drop-down list. Select an application to add it to your review. Repeat this step for each application you want to add to your access review.
6. If you need to adjust the reviewer(s) assigned to your review, do this now. If no reviewer is assigned to an app, select the Add button for that app and begin typing to search for a specific user. Select the desired reviewer(s) from the drop-down, then select Save. If a reviewer is already listed for an app but you’d like to remove or replace them, or add additional reviewers, select the Ellipses button for that app. Select Edit reviewer, and begin typing to search for new reviewers to add, or select the X to remove the currently assigned reviewer.
7. To make changes to your access review before launch, select the ellipses button at the top-right of the access review page. Then select Access review settings. Make sure all your selections are correct before launching. Access review fields, except for the review title, can no longer be edited once the review is in-progress.
8. Select Launch to initiate your review. 

Manage access reviews

SaaS Manager offers a number of ways to customize how you sort and view information within your access reviews. You can take action on individual or multiple accounts, record notes, and mark reviews as accepted or pending. You can also end reviews early, preventing future recurrence and locking in the results. 

Switch between a list or kanban view of all your access reviews with the toggle button at the top of the Access page, or use the search field to find a specific access review.

Complete assigned access reviews

Once your access review is launched, reviewers will get notified when reviews become active and when they’re due. Administrators will get notified when access reviews are completed. Notifications are available via email and slack, with batching for users assigned to multiple reviews. You can manage notification preferences from the Notifications section of the Settings page within your SaaS Manager dashboard. 

See Completing assigned access reviews for more information. 

Export a review

Select the ellipses at the top of the access review page select Export to export the review for sharing with your auditors. The review will export as a `.zip` that includes `.xlsx` and `.csv` files, so you can share just one file that contains all supporting documents with your auditors.