It’s difficult for organizations to stay secure, compliant, and efficient in an ever-expanding SaaS landscape. Every time an employee joins or leaves the company, or a software vendor is added or removed, IT and security teams must grant and revoke permissions, so the right people have access to the right tools. A mistake in this process could allow an offboarded employee to maintain access to sensitive data years after they left the company, so the stakes are high.
To manage this process, companies must develop a SaaS governance strategy: A security framework to manage, secure, and optimize the use of SaaS tools across departments. It defines the policies, roles, and controls that determine how users access sensitive data and resources.
A critical part of a SaaS governance strategy is access reviews. Access reviews are the operational backbone of SaaS governance: Regular, structured evaluations that validate whether users still need the access they’ve been granted. Access reviews are also necessary to create an audit trail for compliance standards such as SOC 2, SOX, PCI DSS, and ISO 27001.
Unfortunately, access reviews are difficult to manage. IT teams often rely on spreadsheets to conduct them because most companies have non-SCIM apps or custom apps that don’t meet standard workflows.
Without standardized workflows, every review cycle becomes a one-off project, varying by application, team, or auditor requirements. The result? Incomplete coverage and time-consuming, error-prone processes. Even if a tool is used for access reviews, it often lacks visibility into app user roles and access levels, requiring reviewers to use several systems, causing delays and potential issues with auditors.
How Trelica by 1Password makes access reviews easier
Recently, Trelica by 1Password introduced an access review feature that enables IT and security teams to conduct continuous and confident reviews.
First, Trelica by 1Password offers optimization workflows to proactively de-provision users who’ve changed roles or left the company.
Second, when it’s time for scheduled reviews (one-off or recurring), teams get a single, standardized workflow to audit access across all required apps, complete with built-in context such as user role, access levels, and access issues – no more switching between tools.
Trelica by 1Password provides comprehensive coverage across your SaaS landscape, featuring over 350 native API integrations for popular applications, a flexible API for custom applications, and support for non-SCIM applications via CSV uploads. It ensures every app, no matter the type, is included in your access reviews.
Reviews are fully automated, with notifications and messages sent to assigned reviewers – whether IT, or app owners – to accelerate completion and ensure accountability. Reviewers can easily approve or flag users with a single click and filter by user, access level, cost center, or issue to make informed, bulk updates efficiently.
Reviews are fully auditable, with clear, exportable reports that include reviewer names, timestamps, and any associated notes. And with direct, in-line actions, reviewers can deactivate users or update permissions on the spot or log changes externally, turning insights into impact instantly.
IT managers and security engineers can easily manage and track reviews, getting the visibility they need to confirm that privileged access is limited and appropriately scoped. App owners can review and validate access within their specific tools, like Salesforce, Slack, or NetSuite, without IT having to chase them. And for compliance teams, Trelica by 1Password’s access reviews provide accurate, exportable reports and a clear audit trail to support regulatory requirements and internal audits.
Trelica by 1Password’s access reviews are part of a streamlined approach to SaaS governance. With built-in context, automation, and broad app coverage, access reviews deliver the visibility and control IT, security, and compliance teams need – no spreadsheets required.
Katie Wah
Senior Staff Product Marketing Manager
