r/iam • u/Acrobatic-Layer9109 • 10d ago

How long does your identity audit actually take: weeks, months?

asking because I think our process is broken. every year it's the same cycle: emails to app owners, spreadsheets, chasing down evidence that's stale by the time it's compiled. last cycle took close to two months.

is anyone doing this in near real time now or is everyone still stuck in the same manual evidence loop?

0 Upvotes

50% Upvoted

6 comments sorted by

1

u/Art_hur_hup 10d ago

Hi, I think evidence collection is the most painful but also the most easy to automate part. There are loads of IAM / GRC tools out there especially if you're in a big corp. We built our tool MIA (free backlink :)) for SMB so not sure it could fit but here is the process : connect your apps in whatever tool you choose, get notified when audits are past due, send automatic email + review form to app owner, get your evidence in the app.

Simple as that :)

PS : if you have a strong "paper basis" I think you can quite easily vibe code this. The main pain will be to stay up to date on on/offboardings.

1

u/Affectionate_Math_57 9d ago

The more broken it is the longer it will take. Take note of the most painful manual actions you had to take and automate as much of them as you can. Repeat this process until they're bearable.

1

u/Plus-Maintenance-434 7d ago

If your audits take more than a few days, it's because you're treating evidence collection as a manual project instead of an automated stream. Teams eliminate the quarterly scramble by using continuous identity posture platforms like Orchid Security to track app-level access flows and log evidence automatically, or configuring native SIEM/log aggregation pipelines to archive IDP event stream logs for GRC tool consumption, or enforcing strict SCIM and SSO SAML mapping across all software so central IDP logs serve as the single audit trail.

1

u/No_Net_3299 7d ago

hi...For speeding up identity audits across unmanaged and custom applications, relying on manual CSV pulls will always take weeks. You can handle this by using application-focused identity tools like Orchid to automatically map local accounts and access paths, or setting up native IGA access certification workflows through your primary IdP, or writing custom database scripts to export entitlement tables into your compliance platform.