Overview

This guide is for remediation owners: the people responsible for removing or downgrading access for users who were rejected in an access review. For an overview of the feature, see the main Access review article.

After all reviewers sign off, Torii opens a remediation task for the rejected users. You can remove access directly from Torii by running actions, or manually in the target app. The task has two steps.

Step 1 – Run Actions

This step lists every user who was rejected during the review.

Click Run actions above the table and choose the action to perform. You can run it for all applicable users, or select specific users first. Depending on the app, available actions include:

• Native app actions, such as suspending a user — integrated apps only
• Removing users from IdP/HRMS groups — all apps
• Opening tickets in ticketing systems — all apps
• Custom actions — all apps

After you run an action, its status shows as In progress, then changes to Completed once it finishes successfully. When all actions have finished, click Continue.

Step 2 – Verify Compliance

In this step, you confirm that access was removed for rejected users.

• Integrated apps: Torii uses the latest synced account data to check whether rejected users' statuses changed to Inactive or No longer in app.
• Non-integrated apps: Upload an updated user list so Torii can verify that rejected users no longer have access.

If a rejected user is still Active, their remediation status shows as Incomplete. You can still submit the report: add comments or upload supporting evidence, such as screenshots from the app's admin portal, to show the access was removed.

Submit the Report

Click Submit to finalize the review.

• For integrated apps that weren't fully synced in the previous step, submitting triggers a final sync to retrieve the latest user statuses.
• The review status changes to Completed on the campaign page.
• Torii creates a downloadable report, including details of remediation actions run through Torii and when they completed.
• Click Share to download the report or send it to stakeholders by email or Slack, in PDF or CSV format.
• Once the whole campaign is complete, its report can be downloaded or shared as a ZIP file with detailed files for every access review in the campaign.