Access review
By Toolspoke
Lists who can reach each app in Okta, and names the accounts that should have been removed, for a person to act on.
Needs a Toolspoke account. You choose which project it installs into.
Okta
Its last step
Write the review
- Okta
- Required integrations
- Runs when you ask
- No schedule of its own
- Write the review
- What its last step does
- Nothing destructive
- 0 of 12 actions in its tools
On this page
The short version
- What it is
- Lists who can reach each app in Okta, and names the accounts that should have been removed, for a person to act on.
- Works with
- Okta
- How often
- When you ask it to.
- What it never does
- Deactivate, suspend, unassign or change the role of any user.
- What you need
- A Toolspoke account, with Okta connected.
How it works
What each run does, from the "Steps" part of its own instructions.
- Step 1:
List the applications and, for each, the users and groups assigned to it. Expand groups into their members, so the list names people, not only group names.
- Step 2:
List the users with their status, last sign-in, and their enrolled sign-in factors.
- Step 3:
Flag what looks wrong
Deactivated or suspended users still assigned to an application. No sign-in for 90 days while still active. These are often people who left and were never removed. No second factor enrolled on an account that can reach an admin or finance application. Admin...
- Step 4:
Check the recent history
Read the system log for the last 30 days for admin role grants and new application assignments. A grant nobody remembers making is the most important row in the review.
- Step 5:
Write the review one table per application with name, access level and last sign-in. Then the flagged list, each row with the reason it is flagged and who should decide.
What you get
How the agent's own instructions describe what it hands back. Install it to see a real result.
Write the review one table per application with name, access level and last sign-in. Then the flagged list, each row with the reason it is flagged and who should decide.
Integrations & requirements
Access review needs Okta to work. You sign in to each one yourself.
Okta
RequiredRead an Okta org's users, groups, applications, MFA enrolment and system log.
Authentication: API token (SSWS)
Skills it follows
| Tool | Actions it offers |
|---|---|
| Okta | 12 in all: 12 read, 0 write, 0 destructive. Nothing that deletes or permanently changes anything. |
A project can switch any action off, and every call is logged. The counts are what each tool offers; which of them the agent uses is up to its instructions.
What it will never do
- Deactivate, suspend, unassign or change the role of any user.
- Reset a password or a factor.
- Share the review outside the person who asked.
If something goes wrong
If an application's assignments cannot be read, name it in the review as not checked. A review that silently skips an application reads as a clean one, and that is the one an auditor finds.
These are written into Access review's instructions. They guide the agent, but they are not a permission. What it is allowed to touch is set by the access you grant.
When it runs
Access review has no schedule. It runs when you ask it to.
Install it into a project, or copy it to the builder and change its instructions, tools and skills.
Use Access review
Pick a project and connect the tools it needs.