performing-privileged-account-access-review

Privileged account access review enumerates accounts across Active Directory, AWS IAM, Azure AD, databases, and PAM vaults to discover stale, shared, and excessive privileges. It outputs JSON or CSV compliance reports with severity classifications for remediation tracking.

Detecting stale and shared privileged accounts requires automated checks against configurable inactivity and recertification thresholds. This process identifies orphaned service accounts, generic accounts without owners, and overdue recertifications to enforce least privilege during audits.

Yes, you can generate reviewer CSVs and JSON compliance reports for Azure AD and database administrators. The review campaigns validate required access, classify findings by severity, and export audit evidence for disabled or orphaned accounts.

Privileged account recertification integrates with PAM inventories and ticketing systems through configurable review campaigns. It consolidates discovered accounts from PAM vaults into a unified inventory and exports structured findings to track remediation progress.

Yes, scanning privileged accounts requires Python dependencies including ldap3 for Active Directory, boto3 for AWS IAM, and msal for Azure AD. These libraries enable automated discovery and validation across enterprise systems during access reviews.

Configuring thresholds for excessive privilege assignments involves setting stale account inactivity periods and recertification due dates. The automated checks apply these configurable parameters to flag domain admins, service accounts, and cloud owners requiring access validation.