key, lock, security, closed, seven, safe, number, brown security, brown numbers, brown key, lock, seven, seven, seven, seven, seven, safe, number
Photo by Taken on Pixabay

Identity

Part of Cloud identity and access

Reviewing privileged cloud accounts

Identify privileged cloud grants, confirm each business need and close retain, reduce or remove decisions with platform limits in view.

Desk Cloud Governance · · 2 min read

Review privileged cloud access by identifying who can perform high-impact actions, confirming why each grant remains necessary and closing every review item with a decision. Include direct and inherited access. A list of administrators with no owner or action is only an inventory.

Build the review population

Include people and accounts that can assign roles, change identity settings, administer production resources or access sensitive data. Cover permanent and activatable grants, relevant groups, external administrators and emergency accounts. Review workload identities against their applications in a separate queue.

For each grant, record identity, role, resource scope, access path, business owner, technical contact and any expiry. Compare this with current staff and contractor records. Act promptly on a departure or role change rather than waiting for the next scheduled review.

Ask for a decision on each grant

Give the owner enough context to answer:

  1. Which current duty requires this privilege?
  2. Could a narrower role or resource scope do the work?
  3. Is standing access needed, or would time-limited elevation fit?
  4. Who will approve and carry out the change?

Mark the grant retain, reduce, remove or investigate, with a reason and action owner. An unanswered request is not an approval. For an emergency account, confirm its purpose, sign-in protection, access route and procedure for checking use.

Read platform evidence carefully

Microsoft Entra Privileged Identity Management can run reviews of Microsoft Entra and Azure resource roles. It requires applicable licensing and permissions. Access reviews for service principals also require Microsoft Entra Workload ID Premium alongside the stated Entra licence.

Confirm the organisation's plan before relying on that feature. A PIM review takes a snapshot when its review instance begins, so changes made during it appear in a later cycle.

AWS recommends reviewing and removing unused users, roles and permissions. IAM last-accessed information helps identify candidates, but service data includes the date and time when an attempt to access an AWS API was made.

For actions, it reports service management actions such as creation, deletion and modification. Check CloudTrail and owner knowledge before treating the activity view as a complete account of a grant's use.

If you use the Essential Eight as a review reference, document which administrative grants were assessed, who decided and any follow-up action.

Platform-specific evidence sources for access reviews

  • Microsoft Entra PIM Review SnapshotCaptures access state at review start; changes during review appear in next cycle
  • AWS IAM Last-Accessed DataShows API access attempt timestamps; helps identify unused permissions
  • AWS CloudTrail Activity LogsTracks service management actions like creation, deletion and modification

Close the review

Give approved changes an operator and date. Check other roles and group memberships that might still grant the same action after a removal. For a reduction, confirm retained operators can still carry out their required duties through an approved route.

Keep unresolved items visible with a decision date: unknown owner, disputed need, failed reduction or unreviewed emergency account. The useful result is an accountable set of privileged grants and a record of what was retained or changed.

More from Identity