Skip to main content
Audience: Access Request Reviewers and App Admins
Purpose: Provide a knowledge base article for your Access Review owners - specifically those who will be involved in reviewing access, making decisions on access, and revoking access.
Enabling Application Admins to Review and Maintain Secure Access with Lumos

​
Purpose

User Access Reviews (UARs) are critical security practices that ensure individuals only have access necessary for their roles. Regular access reviews help:
  • Prevent data breaches and unauthorized access
  • Maintain compliance with security and audit standards
  • Ensure user permissions are current and relevant

​
Frequency

<Your Company> conducts quarterly user access reviews across applications on a <timeline: monthly, quarterly, annual> basis. The InfoSec team initiates the process by creating an access review in Lumos across applications based on the compliance team’s list.

​
Key Stakeholders:

  • InfoSec
  • IT
  • Compliance

​
How <Your Company> Uses Lumos for Access Reviews

<Your Company> leverages Lumos as the central platform for User Access Reviews. Lumos integrates with your connected applications and aggregates access data into a single view, simplifying and streamlining the review process for delegated App Reviewers.

​
Roles and responsibilities

App Reviewers
  • Conduct timely, accurate reviews of user access
  • Reject or modify access where no longer needed
  • Follow up with users for clarification as required
App Admins
  • Conduct timely, accurate manual removals of access when tasked
  • De-provision access where no longer needed

​
Applications review table

​
Access Review types

Account-Based Reviews
  • Focus: Does the user need access at all?
  • Ideal for apps with limited permissions or few users
  • Common for employment-status checks (Active vs Inactive)
  • Can ALSO be used to assess the entirety of the employees access and remove ONLY permissions they shouldn’t have while keeping the rest intact (via Modify)
Permission-Based Reviews
  • Focus: What level of access is appropriate?
  • Ideal for apps with complex roles or many users
  • Recommended for developer tools or sensitive systems
  • Supports splitting reviews by permission type or reviewer

​
Performing an Access Review in Lumos

You would only follow this path if you wanted to navigate to all reviews yourself, otherwise you can click on the notifications that come to you via email/Slack.
  • Logging In
  • Navigating the Dashboard:
    • From the main menu (left hand side), select “Access Reviews” to view your assigned campaigns.
  • Reviewing Users
    • Each entry includes:
      • Name and Email
      • Employment Status (Active/Inactive)
      • Account Status (Active / Suspended / Deprovisioned)
      • Roles/Permissions (e.g., Viewer, Admin)
      • Last Login date (where available)
  • Taking Action
    • Choose one of the following for each user:
      • Mark as Accepted (Green Check) – user still needs current access
      • Modify (Red X) – downgrade or remove certain roles (NO ability to delegate NEW permissions)
      • Reject (Red X) – access is no longer required
      • Reassign Review (Click on your initials) – If you are not the right person to make this decision, you can reassign when appropriate

​
Slack Access Review (example app)

​
Overview

<Your Company> uses Lumos + API integrations to pull user access details from Slack and match it with employment status from Okta.
  • Integration Type: Direct API
  • Employment Source of Truth: Okta
  • Review Type: Account Review

​
What’s Synced from Slack?

​
Status mapping

​
Review scope

Users will appear in the Lumos Slack campaign if they:
  • Exist in Slack
  • Are marked Active or Suspended in Lumos
  • Are Inactive in Okta (needs attention)
  • Have assigned roles

​
Review actions in Slack campaign

​
<Your Company> best practices

  • Revoke users with Inactive Employment status or no recent login (where available)
  • Downgrade Admins/Developers who no longer need elevated roles
  • Re-assign or ask for help when unsure — better safe than sorry
  • Apply the Principle of Least Privilege in all decisions