Complass
Access reviews with Entra ID and GitHub: who may do what, who reviewed it and whether the removal was carried out
The auditor asks for the last review of administrator rights. The answer is a spreadsheet from last year, and a third of the accounts in it no longer exist. Whether the removals decided back then were carried out, nobody knows.
ISO/IEC 27001 requires access rights to be reviewed, modified and removed regularly (Annex A 5.18). For NIS2 entities, access control is one of the minimum measures (§ 30(2) no. 9 BSIG), and Implementing Regulation (EU) 2024/2690 requires the results of the review including the changes to be documented.
The whitepaper shows why the annual spreadsheet round does not hold up, what makes a good access review and how identity connectors for Microsoft Entra ID and GitHub deliver current data, read-only. It describes the campaign from scope to sealed evidence and how the next sync proves that a removal has been carried out. With an 8-step plan, a practice example and a checklist.
Each implementation chapter includes a short "Implementation in Complass" box (decision W11); only features already live are named.
12 pages · Version 1.0 · as of 17.10.2026 · Author Marc Linden, Complass GmbH i. G.
Try Complass with your own data
Set up your trial yourself, with a sample project per framework if you like. If you would rather see Complass first, request a demo.