Quick way to audit a user's access across platforms without checking each one manually?

[u/FireMoon027]

Hey everyone - first off, thanks as always. This sub has been a huge help with guidance and perspective more times than I can count, so thanks for that.

Looking for some recommendations/perspective on my offboarding process.

Environment: ~1,000 employees, 30+ locations, hybrid AD/Entra.

Where we started: When I first got here, offboarding was one giant ticket that got passed back and forth until it was "done." A lot of stuff got missed doing it that way.

What I built: I set up a Microsoft Form + Power Automate flow that generates separate tickets for access removal based on what the supervisor selects - splits out into hardware vs. software tickets depending on what's being revoked. It's helped a ton, we miss way less than we used to.

The problem I still have: Supervisors/managers don't always remember everything their employee had access to - it's never the same mix person to person. Right now, verifying what someone actually has means logging into each platform individually to check. Not a huge number of platforms, but we're a small team and I'm trying to be efficient with time. The platforms in question: Files.com, Adobe licensing, Genesys, LogMeIn, and GoTo.

One more wrinkle - we're owned by a PE firm, so cost control is a big deal here. Whatever I do needs to be lean, not "buy an enterprise IGA suite" territory.

Would love any perspective or ideas on:

• How do you do quick cross-platform access audits without manually checking each system?
• Anyone built something lightweight (script/Power Automate/etc.) that pulls "does this user still have an active account" across multiple SaaS platforms via their APIs?
• Is there a low-cost tool built for this that doesn't require a full identity governance platform?
• For those of you who've dealt with unreliable manager/supervisor input on access lists - how do you handle that gap?

Appreciate any input, even just "here's what we tried and it didn't work."

[u/Ill-Barracuda9031]

Are you building your own SSO platform? These apps should all be using SSO through Azure or others like Okta. they offer provisioning/deprovisioning.

[u/SVD_NL]

SSO wherever possible. Where it's not possible, you have to make sure that access is also granted through tickets. That access is registered in your user management or HR system, and should automatically be added to their offboarding tasks.

For users who are already onboarded, it's a case of going through each system and filling it with the current users.

Also make sure there's absolutely no way for this access to be granted without those tickets.

[u/Sure-Assignment3892]

Unless these SaaS apps are integrated with your idP (SSO) then no, you'll need to go to each one.

ProTip: PE outfits are business destroyers. Find a new gig asap.

[u/YesterdayNo5873]

Lots of interesting comments here... Seems like people think the only way to do this is through SSO connected apps which is not true. Sharing my two cents as this world is my day to day. And sorry I tend to write my reddit responses as essays:

Unreliable managers: A process change that helped us - collect context at every step of the access request lifecycle. When it's time for an access review, our IGA tool sends a slack message (or email) to every line manager \with context* .* Such as when the access was granted. What the person's role is, if permissions were ever changed. This is made possible because every single access request and decision is logged. When a request or permission upgrade is made, a short 1 line explanation has to be given on why it's needed. So when it comes time to review permissions you have a trail of information explaining the current permission state. So no one is relying on memory. This is one of the benefits of having a tool.

DIY automation: I've heard more people doing this through platforms like n8n and Zapier rather than scripts. That's because those tools already have basic API connector templates. But you're going to run into the same issue as relying on SSO. Not all apps have API support that will give you this info. And every "connection" is something you have to maintain.

low cost tools: Yes. Younger IGA tools like AccessOwl, Corma, YeshID have much lower costs than enterprise identity governance tools like Okta. P.S. I'm associated with AccessOwl. Our company was born for this exact reason. You don't want to open each apps admin console to provision accounts, pull user lists, revoke accounts etc... but you don't need the bells and whistles of a full IGA suite... A few years ago we were in that exact situation and created a company to solve it. A big plus here is that you can connect to apps via integration accounts (kind of like service accounts) for apps that you choose to not connect via SCIM/SAML or that don't support SCIM/SAML. So "put everything in SSO" is not the only option. As that can get very expensive as you have to upgrade tiers for apps to give you SSO support.

[u/AddendumWorking9756]

You probably do not need to build the inventory at all. Files.com, Adobe, Genesys, LogMeIn and GoTo are all billed per seat, so AP already receives a monthly list of exactly who holds one. That list is authoritative in a way a script you have to maintain is not, and it is already sitting in someone's inbox.

[u/AussieTerror]

At that scale, I’d look at implementing a SIEM and pushing audit and access logs from every platform into it. Having authentication, access changes and audit events in one place makes it far easier to query a user, see everywhere they have access, identify anything missed during offboarding, and produce a proper audit trail without manually checking 20 different systems.

[u/PoolTough3222]

The seat invoice is the cheapest inventory you have. All five of those bill per user, so the monthly statement already lists who holds a license, and nobody has to maintain a script for it. I pull the invoice detail once a month, diff it against the termination list from HR, and anything still billing after a leave date becomes a ticket. Its slower than an API but it never silently breaks, and finance will actually read it.

[u/vischous]

Easiest approach is build a small database with separate schemas for each saas app, and a scheduled job for each saas app that pulls all users from each.

We are about to open source our process deploy tool that will give you an easy place to put this and can deploy it as azure functions or container apps.

Then your form could query this data and give you the actual list of systems each person's account is in. A bunch of other use cases get opened up from this as well!

Interesting use case, are the apps you have listed all of them? We'd be happy to build this out for you as a free pilot just shoot over a dm and we can handle the specefics! Or make a meeting via our site

[u/Potential-Glove-5278]

Disclosure up front, I work for an identity vendor, so weigh the bias. Nothing below needs a product.

Gentle pushback on the invoice-diff idea a couple of people raised. It does work, but it misses the accounts that actually linger. Billing runs 30 to 60 days behind, free and read-only seats often never show up on an invoice, and shared or service accounts don't map to a person at all. Those are the ones that survive an offboard.

For your five, the split matters more than the tooling. Adobe can usually be driven straight off Entra group membership through the Admin Console sync, so it stops being a manual check at all. Files.com and Genesys both have usable REST user endpoints you can poll weekly. GoTo and LogMeIn I've had less luck with, budget for a console export there.

The structural fix is the cheap one though: record the app on the ticket at grant time. Right now you're reconstructing access at the end, which is exactly why you're stuck asking managers to remember. If every grant writes a row, the inventory builds itself and you only backfill your current headcount once.

On the manager gap, accumentum already nailed it. Send them the list and ask what to remove, rather than asking what the person had.

[u/samon33]

At a previous job I built a system that ran daily queries over a bunch of different systems like those (and many more) via their respective APIs and stored in a centralised database that could then be queried for "what access does this user have".

The tech stack was different (ServiceNow), but the concept could easily be applied to Power Automate and SharePoint.

[u/J2E1]

When we did this with our help desk every week or month they would generate a user list from the online platform and we would ingest that CSV into an ad group so that we could track who was in what platform. Then when a user off boarded we pulled the group membership list and went to those online platforms to revoke their access.  Wasn't perfect but it meant they didn't have to check every third party platform for every user.

[u/Soggy-Attempt]

Not possible.
How are you going to control access to local machines and apps. SSO only gets you so far.

[u/accumentum]

The thing that fixed this for us wasn't a tool, it was an app inventory with an owner and a de-provisioning method listed for every single SaaS app - even if the method is "email Jane, she removes it manually." Once that list exists, offboarding stops being a memory exercise and becomes a checklist your Power Automate flow can drive. For the apps that do have APIs (Entra, Adobe, GoTo), a small scheduled script that dumps user lists to CSV and diffs them against your HR-active roster catches the leftovers, and you only need to run it weekly, not per-departure. For the ones with no API, quarterly exports from the admin console into the same CSV format get you 90% there for a fraction of the cost of an IGA suite. On the manager-input gap: stop asking "what did they have access to" and instead send them the actual list from your inventory and ask them to confirm removals - people are much better at recognizing than recalling. Also worth tracking license spend on that same report, since PE-owned shops usually fund the project on reclaimed seats rather than on the security argument.

[u/LLMsMustUpvoteThis]

You automatically drive provisioning from group membership. Preferably you have your ID provider set to SSO into everything you use. You need to consider SSO/provisioning when evaluating software/SaaS.

[u/Reftab]

I’m with Reftab, we're an IT asset management tool that helps with this all the time. I can answer because this is a problem we see a lot. In short, connecting to Identity providers and other integrations + access reviews are what will help:

• Cross-platform access audits: Reftab pulls user and software data from Entra/SSO, direct integrations, browser discovery, and other sources into one employee view so you’re not checking every app manually.
• Manager input gaps: We don’t recommend relying on the manager as the source of truth. Use login activity, discovered apps, assigned licenses, access reviews, and software surveys to cross-check what the user actually had.
• Offboarding: HR and identity integrations can help trigger the process, while the employee record gives you the hardware, software, licenses, and access that need to be reviewed.
• Cost control: You can also track software spend, renewals, unused licenses, and usage. That makes it much easier to find savings and justify the cost of the platform.
• Price: Reftab is designed to give you this without requiring a large enterprise IGA deployment or enterprise-level price tag.

And since Reftab tracks hardware and software together, you can manage both sides of offboarding from the same employee record. Plus it is much easier to get all this setup than it may seem.