An authorization review checks whether a user’s permissions still match their current job duties and business need. It can cover access to applications, files, groups, and privileged roles, including rights assigned directly or inherited through group membership.
Reviews help enforce least privilege by identifying access that is no longer needed, such as permissions left behind after a transfer or promotion. Organizations can trigger a review when roles change and schedule periodic checks to catch stale access. They should remove unnecessary permissions or document why they remain, while recording who reviewed and approved the changes. This reduces the chance that outdated access could be misused to reach sensitive systems or data.