User Access Review works on identity data that DataBee collects from your identity provider. This page lists the feeds User Access Review needs, what each one contributes, and a checklist you can work through with your DataBee contact before your first campaign.
What goes in, what comes out
What goes in:
Application access — your single sign-on (SSO) applications, and the users and groups assigned to each one.
Users and groups — every user, the groups they belong to, and their manager.
Sign-in activity (recommended) — when each user last signed in, so reviewers can spot access that is no longer used.
What comes out:
Review items — one for each user's access to each application, including whether the access was assigned directly or through a group.
Reviewers — each item is routed to the right leader, based on the manager recorded for the user.
An audit-ready record of every decision. See Tracking Activity with the Audit Trail.
What you need
User Access Review supports Microsoft Entra ID and Okta as identity providers. You need the required feeds for at least one of them. Without them, User Access Review still opens, but campaigns have no review items or reviewers.
Microsoft Entra ID
Microsoft Entra ID needs three feeds. Each feed reads a different part of Microsoft Graph, so all three work together.
Feed | Event type | Need | What it provides | Microsoft Graph permissions | Without it |
|---|---|---|---|---|---|
App Role Inventory | Required | Your applications, the users and groups assigned to each one, and the role they hold. |
| There are no applications or assignments to review. | |
User Group Info | Required | Every user, the groups they belong to, and their manager. |
| Group-based access can't be traced to users, and items can't be routed to reviewers. | |
Signin Audits | Recommended | Each user's sign-in activity. |
| Reviews still work, but reviewers can't see whether access is still being used. |
All permissions are Microsoft Graph application permissions and need admin consent. You can use one app registration for all three feeds if it has every permission listed above. Each feed's setup guide (linked in the table) walks through creating the app registration.
A note on names: Microsoft renamed Azure Active Directory to Microsoft Entra ID, so some DataBee feeds still carry the older name. The names don't tell you which data a feed collects. In particular, the separate Azure AD feed (event types Users and Users by groups) is not used by User Access Review. If you already have it, you still need the Microsoft Entra feed with the User Group Info event type.
Okta
Okta needs one feed, Okta SSO, with these event types:
Event type | Need | What it provides |
|---|---|---|
Apps with Users | Required | Your applications and the users assigned to each one directly. |
Apps with Groups | Required | Your applications and the groups assigned to each one. |
Users | Required | Every user, the groups they belong to, and their manager. |
Signin Logs | Recommended | Each user's sign-in activity. |
The Okta SSO feed needs an API service app with the okta.apps.read, okta.users.read, okta.groups.read, and okta.logs.read scopes and the Read-only Administrator role. See the Okta SSO setup guide.
How Okta managers are found: the feed reads each user's managerId profile attribute and looks for the user whose employeeNumber matches it. For managers to be found, managerId must hold the manager's employee number, and every manager must have employeeNumber set. If your organization stores the manager's email address or login in managerId, no manager is found and those users' access can't be routed to a reviewer.
Data quality that matters
Managers are filled in. Review items are routed by each user's manager. Users with no manager, or with a manager whose email address is missing or invalid, can't be routed to a reviewer. In Okta, this also means
managerIdmust match the manager'semployeeNumber(see Okta). The campaign dashboard warns you about reviewers with invalid emails, but it is quicker to fix them in your identity provider first.Applications are assigned through SSO. User Access Review covers the applications your identity provider assigns users and groups to. Access managed only inside an application, outside your identity provider, doesn't appear.
Feeds are running before you create a campaign. A campaign is a point-in-time snapshot of the access data at the moment you create it. Let the feeds complete at least one full collection first.
Access
To connect feeds, a user needs permission to manage data feeds.
To run campaigns and review access, users need the User Access Review permissions described in Roles and permissions. User Access Review must also be enabled for your tenant.
Checklist
Work through this list with your DataBee contact. Identity provider credentials and admin consent take the longest, so start those first.
Microsoft Entra ID
☐ App registration created, with
Application.Read.All,User.Read.All,Directory.Read.All, andAuditLog.Read.Allapplication permissions and admin consent granted☐ Microsoft Entra App Role Inventory feed connected, with the App Role Inventory event type
☐ Microsoft Entra feed connected, with the User Group Info event type
☐ Azure AD Sign-in feed connected — recommended
Okta
☐ Okta API service app created, with the four scopes and the Read-only Administrator role
☐ Okta SSO feed connected, with Apps with Users, Apps with Groups, and Users event types
☐ Each user's
managerIdholds the manager'semployeeNumber☐ Signin Logs event type enabled — recommended
Both
☐ Users in scope have a manager with a valid email address in your identity provider
☐ Feeds have completed at least one collection
☐ Campaign managers and reviewers given the User Access Review permissions
How to tell it's working
The Access Reviews page shows a banner while feeds are missing. It lists each missing feed with its required and recommended event types.
A warning banner, User Access Review requires additional feed configuration to function, means no identity provider has all its required feeds yet. Campaigns would be empty.
An information banner, User Access Review is active — optional enrichment feeds are available, means the required feeds are in place and only recommended feeds are missing. You can select Don't show this again for a feed you don't plan to add.
No banner means every required and recommended feed is configured.
If you have permission to manage data feeds, each missing feed has a Configure button that takes you to its setup page.
The banner checks that the feeds and event types are configured, not that data has arrived. After the feeds have run, confirm:
The applications you plan to review appear in the Applications list when you create a campaign.
Review items show the access path (direct or through a group) and a reviewer.
The campaign dashboard shows no warning about invalid reviewer emails.