Overview

Regular user access reviews are an essential part of SaaS management. They help organizations ensure that only the right people have access to the right applications—reducing security risk, minimizing excessive permissions, and meeting compliance requirements such as SOC 2, ISO 27001, and HIPAA.

Torii supports end-to-end management of user access reviews in one centralized place. Whether you're managing dozens or hundreds of apps, Torii helps you assign reviewers, track decisions, and document results in a consistent, audit-friendly format. Instead of managing reviews in disconnected spreadsheets, teams collaborate directly in Torii.

Available for customers on the Enterprise plan and the Torii Identity module.

Benefits

• Streamlined & auditable: Replace manual spreadsheets with a built-in, end-to-end access review process.
• Data-backed decisions: Use usage insights, SSO and HRMS data, and Torii recommendations to inform reviewer decisions.
• Integrated & flexible: Launch reviews across integrated and non-integrated apps, covering all user accounts.
• Collaborative: Assign multiple reviewers to each app, decentralizing the process to app or account owners.
• Audit-ready & shareable: Submit and export reviews as shareable reports, ready for compliance.

How It Works

An access review involves three roles. Each has its own guide:

IT admins (anyone with the Access Reviews – Take Action scope in Torii)

• Configure which user fields reviewers can see
• Launch and assign access review campaigns from the Access Reviews page
• Monitor campaign progress
• Download and distribute completed campaign reports for compliance

Reviewers (usually app owners)

• Receive notifications when assigned to a review
• Review each user's access in a guided interface, using usage data and Torii recommendations
• Approve or reject access and add comments to explain decisions
• Sign off when all users have been evaluated

Remediation owners (usually IT team members)

• Remove or downgrade access for rejected users, directly from Torii or in the app
• Verify that access was removed
• Submit the final report

This structure distributes responsibility while keeping the process consistent and trackable across your organization.

Prerequisites

• Fresh user data. Connect integrations for the apps you need to review, or upload user files to populate the user list for non-integrated apps. For non-integrated apps that are fully managed by app owners or other stakeholders, Torii will guide the reviewer to upload a user file first.
• Permissions. To assign reviewers who are Torii members, make sure they have the Access Reviews – Take Action scope. Users with this scope have access to all reviews, whether or not they are assigned as a reviewer, and see all user fields. App owners without Torii access can also be assigned.

Where to Go Next

• Admins: Launching and Managing Access Review Campaigns — configure access review settings, launch campaigns, and monitor progress.
• Reviewers: Conducting an Access Review — review users' access and sign off.
• Remediation owners: Remediating Rejected Access and Submitting the Report — remove rejected access and submit the final report.

Best Practices

• Conduct reviews regularly. Run access reviews at least quarterly for high-risk, high-cost, or sensitive applications.
• Delegate to app owners. Use custom fields (e.g., App Owner) to assign reviews to the most knowledgeable stakeholders and decentralize responsibility.
• Establish clear ownership. Identify and assign the right app owners or department leads early to avoid delays.
• Limit what reviewers see. Use access review settings to share only the user fields reviewers need, and keep sensitive HR data private.
• Prepare reviewers in advance. Brief reviewers on expectations and how to interpret the data for a smooth, consistent process.
• Ensure data accuracy before launch. Sync integrations or upload updated user files so reviewers work with complete, current data.
• Encourage context in comments. When rejecting access, reviewers should document their rationale to support future audits.
• Log manual removals. If access is revoked directly in the app, record the action in the comments field for traceability.
• Monitor review progress. Use the Access Reviews page to track which reviews are in progress, completed, or pending, and follow up as needed.
• Standardize your review cadence. Document your review schedule (e.g., quarterly or before compliance audits) and align it with internal security and audit workflows.

FAQs

Q: Can I launch reviews for apps with multiple accounts? A: Yes. Torii includes users from all integrated accounts in one consolidated review.

Q: Can I launch reviews for non-integrated apps? A: Yes. Reviewers will be prompted to upload a current user list before proceeding.

Q: Can I assign different reviewers to different accounts within the same app? A: Not yet. However, you can assign multiple reviewers to the same app and ask each to focus on specific accounts.

Q: Can reviewers access reports later? A: Yes. Completed campaigns remain available under the Completed tab, and their reports can be exported anytime.