Rencore
Access Reviews & Attestation
Periodic access review campaigns tuned for Microsoft 365, SharePoint permissions, Teams membership, Group ownership, guest access. Schedule, attest, track completion, close the loop with remediation actions.
Access Reviews & Attestation is Rencore's compliance capability for periodic certification of access rights. Campaigns target specific resource types, SharePoint sites, Teams, Groups, guests, assign reviewers, set deadlines, and track completion. Resource owners attest whether each access is still appropriate; bulk attestation handles routine cases; delegation handles vacations; remediation actions execute the outcomes. Required evidence for SOC 2 CC6.2, ISO 27001 A.9, and every major compliance framework.
Why access reviews matter
Access accumulates. Over a year, average M365 users gain access to dozens of new sites, channels, and groups they no longer need. Without periodic review, the access stays in place, every new permission compounds with every old one. Compliance frameworks require periodic certification specifically because the natural drift is one-directional.
Manual access reviews are notoriously friction-heavy. Reviewers receive long lists, do not understand the context for each entry, attest by approving everything (or by approving nothing). The compliance evidence shows reviews happened, but the underlying access stays unchanged. The certification is theater.
How Rencore makes it real
Reviews target specific resource scopes (one site, one team, one group) rather than dumping unfiltered access lists on reviewers. Each review entry includes context, last activity, sharing breadth, sensitivity classification, that helps the reviewer make an informed decision in seconds rather than minutes. Bulk operations handle the cases where context-free approval is actually appropriate.
Outcomes drive automated remediation. Access flagged as inappropriate triggers the remediation action (remove user, downgrade permission) automatically, with approval gating for sensitive cases. The compliance record shows what was reviewed and what changed.
Evidence pack
Each campaign produces an evidence record, reviewers assigned, completion rates, attestation outcomes, remediation actions executed. The record is exportable in formats the auditor will accept (PDF for presentation, CSV for analysis) and is retained according to the configured retention policy.
Frequently asked questions
What is Rencore governance?
How do Rencore policies work?
What is Copilot governance?
Trusted by
