> ## Documentation Index > Fetch the complete documentation index at: https://docs.lumos.com/llms.txt > Use this file to discover all available pages before exploring further. # User Access Reviews Knowledge Base Template > Adapt a knowledge base template for Reviewers and App Admins that covers Access Review roles, review types, how to act in Lumos, and a Slack example. **Audience:** Access Request Reviewers and App Admins\ **Purpose:** Provide a knowledge base article for your Access Review owners - specifically those who will be involved in reviewing access, making decisions on access, and revoking access. *** *Enabling Application Admins to Review and Maintain Secure Access with Lumos* ## **Purpose** User Access Reviews (UARs) are critical security practices that ensure individuals only have access necessary for their roles. Regular access reviews help: * Prevent data breaches and unauthorized access * Maintain compliance with security and audit standards * Ensure user permissions are current and relevant *** ## **Frequency** `` conducts quarterly user access reviews across applications on a `` basis. The InfoSec team initiates the process by creating an access review in Lumos across applications based on the compliance team’s list. ### **Key Stakeholders:** * InfoSec * IT * Compliance *** ## **How `` Uses Lumos for Access Reviews** `` leverages Lumos as the central platform for User Access Reviews. Lumos integrates with your connected applications and aggregates access data into a single view, simplifying and streamlining the review process for delegated App Reviewers. *** ## **Roles and responsibilities** **App Reviewers** * Conduct timely, accurate reviews of user access * Reject or modify access where no longer needed * Follow up with users for clarification as required **App Admins** * Conduct timely, accurate manual removals of access when tasked * De-provision access where no longer needed *** ## **Applications review table** | **App Name** | **App Admin / Owner** | **Reviewer(s)** | **Review Frequency** | **Review by (Account/Permission)** | | - | - | - | - | - | | Your App Names | | | Quarterly | Account | | | | | Quarterly | Account | | | | | Quarterly | Account | | | | | Quarterly | Account | | | | | Quarterly | Account | | | | | Quarterly | Account | | | | | Quarterly | Account | | | | | Quarterly | Account | | | | | Quarterly | Account | | | | | Quarterly | Account | | | | | Quarterly | Account | | | | | Quarterly | Account | *** ## **Access Review types** **Account-Based Reviews** * Focus: Does the user need access at all? * Ideal for apps with limited permissions or few users * Common for employment-status checks (Active vs Inactive) * Can ALSO be used to assess the entirety of the employees access and remove ONLY permissions they shouldn’t have while keeping the rest intact (via Modify) **Permission-Based Reviews** * Focus: What level of access is appropriate? * Ideal for apps with complex roles or many users * Recommended for developer tools or sensitive systems * Supports splitting reviews by permission type or reviewer *** ## **Performing an Access Review in Lumos** *You would only follow this path if you wanted to navigate to all reviews yourself, otherwise you can click on the notifications that come to you via email/Slack.* * Logging In * Go to[https://app.lumosidentity.com/](https://app.lumosidentity.com/) and log in using `` SSO. * Navigating the Dashboard: * From the main menu (left hand side), select “Access Reviews” to view your assigned campaigns. * Reviewing Users * Each entry includes: * Name and Email * Employment Status (Active/Inactive) * Account Status (Active / Suspended / Deprovisioned) * Roles/Permissions (e.g., Viewer, Admin) * Last Login date (where available) * Taking Action * Choose one of the following for each user: * Mark as Accepted (Green Check) – user still needs current access * Modify (Red X) – downgrade or remove certain roles (NO ability to delegate NEW permissions) * Reject (Red X) – access is no longer required * Reassign Review (Click on your initials) – If you are not the right person to make this decision, you can reassign when appropriate *** ## **Slack Access Review (example app)** ### **Overview** `` uses Lumos + API integrations to pull user access details from Slack and match it with employment status from Okta. * Integration Type: Direct API * Employment Source of Truth: Okta * Review Type: Account Review ### **What’s Synced from Slack?** | **Data Element** | **Synced?** | **Notes** | | - | - | - | | Name and Email | Yes | Pulled from Slack user profile | | Account Status | Yes | Get Users:[https://api.slack.com/methods/users.list](https://api.slack.com/methods/users.list) | | Roles | Yes | Slack API endpoint:[https://api.slack.com/methods/users.list](https://api.slack.com/methods/users.list) | | Last Login | No | Only available if Slack instance is on Enterprise Grid plan | ### **Status mapping** | **Slack Status** | **Lumos Status** | | - | - | | active | Active | | deactivated | Suspended | | deleted (Slack no longer returns a user) | Deprovisioned | ### **Review scope** Users will appear in the Lumos Slack campaign if they: * Exist in Slack * Are marked Active or Suspended in Lumos * Are Inactive in Okta (needs attention) * Have assigned roles ### **Review actions in Slack campaign** | **Action** | **Effect in Lumos** | **Effect in Slack** | | - | - | - | | Accept | No change | Access retained | | Modify | Role updated | Certain Permissions removed | | Reject | Marked as Deprovisioned | User deleted, content lost unless transferred | | Suspend | Marked as Suspended | Wipes sessions, sets user deactivated, reclaims license (*Enterprise Grid only*) | *** ## **`` best practices** * Revoke users with Inactive Employment status or no recent login (where available) * Downgrade Admins/Developers who no longer need elevated roles * Re-assign or ask for help when unsure — better safe than sorry * Apply the Principle of Least Privilege in all decisions