Every account needs a hand receipt

In the Army, every piece of equipment I was responsible for sat on a hand receipt with my signature next to it. I haven't found a better model for identity governance. This is the longer version of Sheet 15.

The hand receipt

As a team leader in the 82nd Airborne I was accountable for about $250K in equipment. Later I held personal accountability for more than $500K. Every item had a serial number and a person who could say where it was right now. Inventories were routine, not an event.

Four rules for accounts

• An owner. Every account, including service accounts and guests, maps to a person who can answer for it.
• A purpose, written down in one line.
• An end date. Contractor, vendor, and project access expires by default.
• A recurring inventory, done by people who know the users.

Access reviews take the inventory

Entra access reviews cover the inventory. Reviewers can be managers, group owners, selected users, or the users themselves. You can auto-apply the results, and you choose what happens when a reviewer doesn't respond:

• No change
• Remove access
• Approve access
• Take recommendations, which applies the system's suggested decision, such as Deny for anyone who hasn't signed in for 30 days

Be careful with that last choice. Remove access or take recommendations, combined with auto-apply, can revoke all access to the resource if reviewers ignore the review.

An end date and a recurring review also catch the movers in Sheet 05, whose old access nobody removed.

If an auditor asked who owns each service account in your tenant, how long would the answer take?