Drata centralizes application permissions so you can confirm appropriate access, identify risks, and generate audit-ready evidence for annual access control reviews.

Go to Governance → Access Reviews.

The Access Reviews page includes three tabs:

Only one review period can be active at a time.

Once a review period is active, reviewers validate access one application at a time.

To open the Active Review:

Inside the application view, you can:

When all accounts in the application have been reviewed:

When the review period is completed, Drata combines all application evidence into a single ZIP file, with a separate folder for each reviewed application. This file is automatically attached to DCF-11: Annual Access Control Review and saved into evidences. The evidence renewal date is set to one year from the completion date by default.

For accounts using workspaces, evidence is generated only for the Primary workspace. You may need to manually copy the evidence to other workspaces if required.

While performing an access review, you may notice accounts flagged with specific Warnings. These are proactive indicators designed to help you identify security risks or data gaps that require your attention.

To view these warnings, navigate to the Access Reviews page and select the specific application you are reviewing.

Admins can reopen a completed review period if updates are needed. To do this, go to Governance → Access Reviews, open the Completed Reviews tab, and select Re-open review.

Reopening makes the review active again and allows edits to application reviews. This option is only available when no other review is currently active, since only one review period can be active at a time.

Drata's Access Review feature streamlines and automates the user access review process, ensuring that organizations can effectively manage who has access to their systems, applications, and data. This helps reduce risk and supports compliance with various regulatory frameworks.

Note: User Access Review in Drata examines connected applications across all workspaces and auto-generates evidence when access review is completed to the primary workspace.

Additionally, connect Drata to your identity providers, such as Okta or Google Workspace, and other integrated systems as part of the setup process.

On the Access Review page, there are two tabs:

Note: Only one review may be active at a time.

If the application does not show in the list to choose from, you can manually add it.

What happens if I review access after the review period ends?
You’ll be reviewing access as it exists on the day you perform the review. The review will still be tracked under the selected review period for reporting purposes.

Can I meet audit requirements with this approach?
Yes, in many cases. But if your auditor requires point-in-time data, we recommend exporting a CSV of access at the start of the review period for added evidence.

You can manually add an application when setting up a review period under the Reviews tab or by selecting Add Application under the Applications tab.

Upload personnel CSV:

Update personnel list:

If personnel data changes during the review, navigate to the application and select the Upload New Personnel CSV button.

In an active review period, every selected application will have two options: Review Application and Review details. The former will open an application user list, detailing the assigned reviewers, a status summary of all personnel, and the list of all detected account data for that application.

During an active review period, each selected application includes two options:

Select Review Applications to view more information about the desired applications. When entering an individual application to perform a review, there will be a pane of options to help filter the user set.

The top right of the user table also has a search bar to find individual personnel, or certain job titles you may want to explicitly check for.

During an active review, you may see a Change Status button. This button will allow a bulk action to update the status of every selected account and, with one click, change them to a new status. This action can also be performed on each individual account from the account detail drawer, opened by selecting any line of account information from the presented list.

If you click on any individual account record, you can also enter a user detail drawer. This drawer will show much of the same information that the table displays, and includes some additional helpful information, such as a direct link to the user record in the source system (only viewable if you have permissions to view the administration UIs of those systems), that can be pulled up from clicking the ‘View account details’ link in the ‘Access’ section. We also display the raw access information Drata found in the queried system here, and any banners detailing why a warning was detected for the account.

If this drawer is open while performing a review, you can also perform additional actions:

At any time, the applications or timing of the review period can be adjusted by clicking the ‘Edit review period’ prompt in the Reviews view. This will reopen the options selected during review period setup, which can be adjusted with the edit button shown on the right side of each section.

When each account has been reviewed and updated to be audit-ready, an application can be completed by entering its ‘Application Review’ view and clicking the ‘Complete review’ button in the top right corner. This will convert the application review to the ‘Completed’ status, and generate a CSV report of account-related review evidence for the application. A user can also choose to upload additional documents by selecting the ‘Upload additional evidence’ checkbox, but the documents will not be saved or generated until the ‘Submit’ button is clicked.

You can only complete the review period after all applications are marked as Completed. When the review period is completed, all generated evidence will be combined in a zip file, with sub folders for each reviewed application, and added directly as evidence to DCF-11: Annual Access Control Review. Note that at this time, accounts using workspaces will only see this generated for the Primary workspace and it may be needed to copy the evidence elsewhere. The evidence can also be found in the Drata Evidence Library, with a default evidence renewal set one year in the future.

A completed review period will display the period the access review took place in for purposes of organization. If you need to examine the evidence generated for each application, you can click the ‘Evidence’ download button in each application. If instead you want to review the entire combined data set generated for an access review, you can click the ‘Evidence package’ download button to examine everything collected.

To review some of these details directed in the UI, you can click the ‘Review details’ option under any completely reviewed application to view information such as: who the review was completed by, the date it was completed, who all the assigned reviewers were, additional evidence added to the review, and any notes about the particular application made to explain data among you team, or for auditors.

Finally, if an administrator wants to reopen a review because some key piece of evidence was missed, they can re-open the period with the ‘Re-open review’ button. This will force the completed review to become the active review, and will allow you to edit any application's review within this period. Drata only allows one active review period to be open at a time.

Our solution is focused on review and does not include remediation and advanced access management functionality such as workflow automation. If you are interested in those functionalities, we have partnerships with other vendors. Please reach out to your CSM to learn more.