Free template
User Access Review Template (Free CSV and Excel)
A free user access review template, Excel and CSV, with a Decision dropdown. No form or email. How to fill it in, and where a spreadsheet falls short.
Download
Free, with no form and no email.
What is in the file
The template has one row for each access and fifteen columns. If a person holds three roles in a system, that is three rows.
The Excel file has four sheets:
- Review is the table. Its heading row stays in view as you scroll, the columns have a filter, and the Decision column takes only Keep, Remove or Change from a dropdown. It takes up to 10,000 rows.
- How to use repeats the steps below, with a sentence on every column.
- Summary counts the lines, the decisions, and the removals and changes not yet carried out. It also has a place for the owner and the approver to type their names and the date. That is a record of who acknowledged the result, not a signature.
- Example has one made-up row, filled in.
The CSV is the heading row alone, for tools that read CSV or for pasting into a sheet you already have. If it opens with everything in one cell, your Excel expects semicolons: open Excel and use Data > From Text/CSV, and choose Comma as the delimiter.
| Column | What goes in it | Example |
|---|---|---|
| System | The system the access is in. | Keycloak |
| Scope | The walled-off part of the system, such as a Keycloak realm, a GitHub organization or an AWS account. Leave it empty if there is only one. | Realm "corp" |
| Account | The login name or ID the system shows. | priya.n |
| Person | Who the account belongs to. For an account that software uses, the person who looks after it. | Priya N. |
| Manager | The person's manager, who is the first reviewer. | Sam Ortega |
| Access (role or group) | The one role, group or permission this row is about. | Role "billing-admin" |
| How they got it | Directly, through a group, or through a role that contains other roles. Write "Not shown" if the system does not say. | Through the group "finance-team" |
| Last activity | The last time the account was used, if the system records it. Write "Unknown" if it does not. Do not write "Never" unless the system says never. | 2026-08-02 |
| Decision (Keep / Remove / Change) | Keep means the access is right. Remove means it should go. Change means it should be different, such as read-only instead of full. | Change |
| Reason | Why. Needed for Remove and Change, and useful for Keep. | Only reads reports. Change to read-only. |
| Reviewer | The person who decided. It is never the person in the Person column. | Sam Ortega |
| Decided on | The day the decision was made, as a date. | 2026-10-05 |
| Ticket | The number or link of the ticket that tracked the Remove or Change. Leave it empty for Keep. | IT-1042 |
| Carried out by | The administrator who made the change in the system. | Alex Kim |
| Carried out on | The day the change was made, as a date. Leave it empty until it is done: the Summary counts the empty ones. | 2026-10-09 |
The names, the account and the dates in the example are made up.
How to fill it in
- Export the whole list. Take the full list of accounts and access from each system you are reviewing, using the system’s own export, for every environment and every realm, organization or account. Do not edit the export. Keep it exactly as it came, and write down the date.
- Paste it into Review. One row for each access. Put a copy of the raw export in a folder of its own.
- Add the people. Fill in Person and Manager from your list of employees. Fill in How they got it where the system shows it.
- Send the rows out. Each manager gets their own rows, and each system owner gets the rows for their system. Ask one question: does this person still need this access to do their job?
- Collect the decisions. The reviewer picks Keep, Remove or Change, and writes a reason. Fill in Reviewer and Decided on. Nobody reviews their own access.
- Have the changes made. Your administrators carry out each Remove and Change in the system itself. This file changes nothing in your systems. Fill in Ticket, Carried out by and Carried out on for each one.
- Check. At the next export, check that every Remove is gone and every Change shows the new access.
- Acknowledge and file. On the Summary sheet, fill in the date of the export and the systems, and read the counts. The owner and the approver type their names and the date. Save the finished file under a name with the date, and do not edit it again.
The user access review guide explains the reason for each step, and the checklist puts them on one printable page.
Where to get the data
Every system hands over its list in a different way. In general terms:
| Kind of system | Where to look | Watch out for |
|---|---|---|
| Identity provider, such as Keycloak, Okta, Microsoft Entra ID or Google Workspace | The user list in the admin console, or the admin API. Get roles and groups as well as users. | Access that comes through groups, and through roles that contain other roles. A plain list of a Keycloak user's roles can leave these out. Ask for the effective roles. |
| Cloud account, such as AWS | In AWS, the IAM credential report is a CSV with every IAM user and the root user, and when their password and access keys were last used. Add the groups, roles and policies from the IAM console or command line. | The report lists credentials, not what each user is allowed to do. People who sign in through a single sign-on service are not IAM users, so they are not in it. |
| Code hosting, such as GitHub | GitHub lets organization owners export the member list of an organization as CSV or JSON. | The export lists members and whether they are owners. Outside collaborators are not members, so they are not in this export. Team and repository permissions need the Teams pages or the API. |
| Business apps | Look for Users, Members or People in the admin settings, and an Export or Download button. If there is none, ask the vendor or use the API. | A screenshot is the last resort. Write the date on it. |
| Databases and servers | The system's own commands for listing database users and grants, or operating system accounts and groups. | Shared accounts, and accounts that software uses. |
The sources for the AWS and GitHub rows are the AWS documentation on the IAM credential report and the GitHub documentation on exporting member information for your organization. For the Keycloak row, how to run a user access review in Keycloak shows how to get the effective roles.
Whatever the system, check that the list is whole: compare the row count with the system’s own screen, and match the accounts against your employee list. The guide covers how to scope the population.
What a spreadsheet cannot do
A spreadsheet is a fair way to run a review of a few systems. Be honest about where it falls short.
- It does not show who changed what, or when. Anyone with the file can change any cell, including a Decision, and nothing records it. Keep the file where version history is kept, save the finished file under a dated name, and do not edit it again.
- Inherited access is easy to miss. The sheet shows only what you pasted in. If the export leaves out access that comes through a group or a nested role, the sheet does too.
- Some checks can be skipped. The dropdown stops a wrong word being typed into Decision, but pasting over a cell can skip the check.
- Names and dates are typed by hand. Nothing checks that the reviewer is who the cell says.
- It changes nothing and checks nothing in your systems. Someone has to carry out each removal and look at the next export to see that it is gone.
- Copies spread. A sheet sent by email to twenty managers comes back as twenty files.
When a spreadsheet stops being enough
If pasting, chasing and assembling take more time than the decisions do, that is the work Acciew is built for. Its open-source collectors only read. They collect accounts, groups and roles from Keycloak, GitHub and AWS IAM, including access that comes through a group or a nested role. Managers decide from an email link, and you download an evidence pack at the end. Acciew never removes access. Your administrators do that.
Have an access review coming up?
Acciew is in early access. We are looking for design partners: teams with a user access review ahead of them.
Apply as a design partner