Reviews that run themselves
Configured once and then recurring on any schedule, with ordered reviewer stages and a fallback reviewer on each.
- Weekly to yearly, scoped by application or group
- What happens if nobody responds is decided up front

Reviewers see how the access is used, and a denial reaches the directory when the review closes.
Govern, identity governance and administration

Spreadsheet reviews take weeks and prove nothing.
Revoked on paper, still active in the app.
Day-one access takes three days. Last-day access lingers for weeks.

Configured once and then recurring on any schedule, with ordered reviewer stages and a fallback reviewer on each.

The reviewer sees the last sign-in and how often the access is used. Anything unused for ninety days is flagged.

When the review closes, each denial runs against the directory and every attempt is logged.

A joiner is productive on day one, a mover is re-fitted, and a leaver stops being reachable on their last day.

Each person sees what they hold, how they got it, and the review waiting on them.

Reviewers see last sign-in and usage frequency before deciding. Once the review closes, each denial is revoked in Entra.
Last sign-in and usage on every row
A denial calls the directory itself
A failed revoke is reported per account
These are the four things people set up in the first month, and each one is a campaign or a workflow.
The campaign runs over the privileged-role tag every quarter, with the security lead reviewing and the manager as fallback.
The leaver event fires the workflow. Sessions, groups, app assignments, directory roles and OAuth grants come off in one run.
An event policy grants the baseline set when the directory creates the account.
A monthly campaign covers the contractor group. A reviewer who never responds loses the access for them.
Ask in your own words. Nuvio routes to the specialists below and runs them under your permissions. Any action they can take ships off until you enable it.
Reads campaigns and decision patterns, works out who is holding the review up, and packages the evidence for each row.
Joiner, mover and leaver across users, groups and roles, with a single step that strips every entitlement in one run.
Drafts and tunes the automation rules that keep access correct between reviews.