Overview
This guide is for reviewers: app owners and Torii members assigned to decide who should keep access to an app. For an overview of the feature, see the main Access review article.
Start a Review
When you're assigned a review, you'll get a notification by email, Slack, or Teams, plus reminders until the review is done. You can start the review in one of these ways:
By clicking the “Start review” button in the notification
Directly from the Access Reviews tab (available to users with the “Access Reviews – Take Action” permission scope)
Reviewers who do not have access to the Torii platform will be redirected from the notification to the Torii Employee Portal, where they can see their assigned tasks. Access review tasks can be completed directly in the portal.
You don't need to finish in one session. You can close the review at any time and pick up where you left off; progress is saved automatically.
Step 1 – Preview the User List
Before you reach the main review page, Torii checks the quality and freshness of the app's user data, so decisions are based on reliable information. To pass the check, the data must:
- Come from a connected integration or an uploaded user file
- Have been synced or uploaded recently
If the data is outdated or incomplete, Torii shows an error message and disables the Continue button until the issue is resolved.
💡 Tip: Even if the data is marked valid (green), check that the user count matches your expectations. If needed, re-sync the integration or upload a fresh user file. Once you continue, the user list is fixed and can't be updated during the review.
💡 Tip: For non-integrated apps, Torii may let you proceed if you're confident that the user list captured from indirect sources (such as SSO or the browser extension) is accurate. We still recommend uploading an up-to-date user list, since details like user roles are only available when data is synced or uploaded.
Step 2 – Review Users' Access
Once the data passes the check, you'll reach the main review page.
View and customize the user list
The user list is a fixed snapshot from the date the review started. You can add columns to show user attributes relevant to your review, such as department or license type. Offboarded users are flagged with badges.
The columns available to you depend on your organization's access review settings. If you can't find a field you need, ask your Torii admin.
💡 Tip: Add the Is past user column to spot users whose status in your employee source of truth shows they've left the company. They're strong candidates for access revocation.
Approve or reject access
Use the dropdown in the Review status column to mark each user as Approved or Rejected. To act on several users at once, select them in the table and choose Approve or Reject under Bulk actions.
💡 Tip: Use filters to act on specific user segments. For example, when reviewing Salesforce, you might approve only users in the Sales department:
- Apply the Department = Sales filter.
- Click Approve All in View.
- Then either remove the filter and reject the remaining users manually, or change the filter to Department ≠ Sales and click Reject All in View.
Use Torii recommendations
Torii suggests whether to approve or reject each user, based on your organization's access governance policies, user inactivity, or HR signals.
Add comments
Use the Comments field to explain decisions or document manual actions.
💡 Tip: If you revoke a user's access manually in the app's admin console, note it in the comments for audit purposes.
Reassign users you don't know
If the app is used by people you don't know or manage, select those users and click Reassign reviewer from the Bulk actions menu. You can reassign them to a specific person or based on a custom field, such as their BambooHR manager. The reassigned users are removed from your review and new tasks are created for the new assignees.
Track your progress
A progress bar at the bottom of the screen shows how many users you've reviewed.
Step 3 – Sign Off
When you've reviewed every user, sign off the review. Once all assigned reviewers have finished, Torii opens a remediation task for the rejected users. See The Remediation & Reports (remediation owners) article.
FAQs
Q: Why can't I add a certain column? A: Your admin controls which user fields reviewers can see. Ask your Torii admin if you need access to a field that is not currently available.
Q: What happens if integrations break or user lists change mid-review? A: The review is marked as Error and can't be completed. A new review should be launched.