Run a human review of user access
Record what is known, the decision, its rationale and the action that follows.
Content and source check: October 1, 2026 · Operational suggestions
Define the review boundary
Choose one system and a review period. Establish who can explain the business need for access and who can authorize changes. Use generic account labels here if identifying details belong in an approved internal record.
Record facts without filling the gaps
Add accounts individually or paste spreadsheet cells in this order: account label, role / access level, owner role. Preview the rows before adding them. Open each account to record a decision; expand Account details for privilege, MFA and previous-review information. These are reported values, not live checks. Leave an unknown value unknown.
Make a decision with a reason
Retain, modify, remove or investigate each row based on the information available. State the rationale and decision date before treating it as reviewed. Service, shared and emergency accounts may have different dependencies and control designs; involve the responsible technical owner before recommending a change.
Track action separately
A removal decision records intent. It does not revoke access. Give follow-up work an owner and due date, then record completion only when the actual work is verified in the appropriate system. The worksheet keeps the decision date and remediation completion date separate.
Review and sign off
Inspect pending decisions and unfinished actions before recording a sign-off statement. State unresolved limitations. A typed sign-off is a user-supplied statement, not a verified electronic signature. Export the full worksheet; display filters do not remove records from exports.
Source & applicability
MS-ACCESS — What are access reviews?
Access reviews can evaluate continued need for group membership, application access and role assignments. Microsoft product guidance. This worksheet is a manual record and does not connect to Entra or inherit its automation.
SEC-registered and state-registered firms may have different obligations. Have the appropriate professionals review what applies to your firm. No regulatory determination is made here.