---
title: "Before You Begin: What User Access Review Needs"
slug: "before-you-begin-what-user-access-review-needs"
updated: 2026-11-02T21:31:28Z
published: 2026-11-02T21:31:28Z
canonical: "docs.databee.buzz/before-you-begin-what-user-access-review-needs"
---

> ## Documentation Index
> Fetch the complete documentation index at: https://docs.databee.buzz/llms.txt
> Use this file to discover all available pages before exploring further.

# Before You Begin: What User Access Review Needs

User Access Review works on identity data that DataBee collects from your identity provider. This page lists the feeds User Access Review needs, what each one contributes, and a checklist you can work through with your DataBee contact before your first campaign.

## What goes in, what comes out

**What goes in:**

- **Application access** — your single sign-on (SSO) applications, and the users and groups assigned to each one.
- **Users and groups** — every user, the groups they belong to, and their manager.
- **Sign-in activity** *(recommended)* — when each user last signed in, so reviewers can spot access that is no longer used.

**What comes out:**

- **Review items** — one for each user's access to each application, including whether the access was assigned directly or through a group.
- **Reviewers** — each item is routed to the right leader, based on the manager recorded for the user.
- **An audit-ready record** of every decision. See [Tracking Activity with the Audit Trail](/user-manual/docs/tracking-activity-with-the-audit-trail).

## What you need

User Access Review supports **Microsoft Entra ID** and **Okta** as identity providers. You need the required feeds for at least one of them. Without them, User Access Review still opens, but campaigns have no review items or reviewers.

### Microsoft Entra ID

Microsoft Entra ID needs three feeds. Each feed reads a different part of Microsoft Graph, so all three work together.

| Feed | Event type | Need | What it provides | Microsoft Graph permissions | Without it |
| --- | --- | --- | --- | --- | --- |
| [**Microsoft Entra App Role Inventory**](https://docs.databee.buzz/docs/ms-entra-app-role-inventory) | App Role Inventory | Required | Your applications, the users and groups assigned to each one, and the role they hold. | `Application.Read.All` | There are no applications or assignments to review. |
| [**Microsoft Entra**](https://docs.databee.buzz/docs/microsoft-entra) | User Group Info | Required | Every user, the groups they belong to, and their manager. | `User.Read.All`, `Directory.Read.All`, `AuditLog.Read.All` | Group-based access can't be traced to users, and items can't be routed to reviewers. |
| [**Azure AD Sign-in**](https://docs.databee.buzz/docs/azure-ad-signin) | Signin Audits | Recommended | Each user's sign-in activity. | `AuditLog.Read.All`, `Directory.Read.All` | Reviews still work, but reviewers can't see whether access is still being used. |

All permissions are Microsoft Graph *application* permissions and need admin consent. You can use one app registration for all three feeds if it has every permission listed above. Each feed's setup guide (linked in the table) walks through creating the app registration.

**A note on names:** Microsoft renamed Azure Active Directory to Microsoft Entra ID, so some DataBee feeds still carry the older name. The names don't tell you which data a feed collects. In particular, the separate **Azure AD** feed (event types *Users* and *Users by groups*) is **not** used by User Access Review. If you already have it, you still need the Microsoft Entra feed with the *User Group Info* event type.

### Okta

Okta needs one feed, [**Okta SSO**](https://docs.databee.buzz/docs/okta-sso), with these event types:

| Event type | Need | What it provides |
| --- | --- | --- |
| Apps with Users | Required | Your applications and the users assigned to each one directly. |
| Apps with Groups | Required | Your applications and the groups assigned to each one. |
| Users | Required | Every user, the groups they belong to, and their manager. |
| Signin Logs | Recommended | Each user's sign-in activity. |

The Okta SSO feed needs an API service app with the `okta.apps.read`, `okta.users.read`, `okta.groups.read`, and `okta.logs.read` scopes and the Read-only Administrator role. See the [Okta SSO](https://docs.databee.buzz/docs/okta-sso) setup guide.

**How Okta managers are found:** the feed reads each user's `managerId` profile attribute and looks for the user whose `employeeNumber` matches it. For managers to be found, `managerId` must hold the manager's employee number, and every manager must have `employeeNumber` set. If your organization stores the manager's email address or login in `managerId`, no manager is found and those users' access can't be routed to a reviewer.

## Data quality that matters

- **Managers are filled in.** Review items are routed by each user's manager. Users with no manager, or with a manager whose email address is missing or invalid, can't be routed to a reviewer. In Okta, this also means `managerId` must match the manager's `employeeNumber` (see [Okta](/docs/before-you-begin-what-user-access-review-needs#okta)). The campaign dashboard warns you about reviewers with invalid emails, but it is quicker to fix them in your identity provider first.
- **Applications are assigned through SSO.** User Access Review covers the applications your identity provider assigns users and groups to. Access managed only inside an application, outside your identity provider, doesn't appear.
- **Feeds are running before you create a campaign.** A campaign is a point-in-time snapshot of the access data at the moment you create it. Let the feeds complete at least one full collection first.

## Access

- **To connect feeds**, a user needs permission to manage data feeds.
- **To run campaigns and review access**, users need the User Access Review permissions described in [Roles and permissions](/user-manual/docs/user-access-review-overview#roles-and-permissions). User Access Review must also be enabled for your tenant.

## Checklist

Work through this list with your DataBee contact. Identity provider credentials and admin consent take the longest, so start those first.

**Microsoft Entra ID**

- ☐ App registration created, with `Application.Read.All`, `User.Read.All`, `Directory.Read.All`, and `AuditLog.Read.All` application permissions and admin consent granted
- ☐ Microsoft Entra App Role Inventory feed connected, with the *App Role Inventory* event type
- ☐ Microsoft Entra feed connected, with the *User Group Info* event type
- ☐ Azure AD Sign-in feed connected — recommended

**Okta**

- ☐ Okta API service app created, with the four scopes and the Read-only Administrator role
- ☐ Okta SSO feed connected, with *Apps with Users*, *Apps with Groups*, and *Users* event types
- ☐ Each user's `managerId` holds the manager's `employeeNumber`
- ☐ *Signin Logs* event type enabled — recommended

**Both**

- ☐ Users in scope have a manager with a valid email address in your identity provider
- ☐ Feeds have completed at least one collection
- ☐ Campaign managers and reviewers given the User Access Review permissions

## How to tell it's working

The **Access Reviews** page shows a banner while feeds are missing. It lists each missing feed with its required and recommended event types.

- A **warning** banner, *User Access Review requires additional feed configuration to function*, means no identity provider has all its required feeds yet. Campaigns would be empty.
- An **information** banner, *User Access Review is active — optional enrichment feeds are available*, means the required feeds are in place and only recommended feeds are missing. You can select **Don't show this again** for a feed you don't plan to add.
- **No banner** means every required and recommended feed is configured.

If you have permission to manage data feeds, each missing feed has a **Configure** button that takes you to its setup page.

The banner checks that the feeds and event types are configured, not that data has arrived. After the feeds have run, confirm:

- The applications you plan to review appear in the **Applications** list when you create a campaign.
- Review items show the access path (direct or through a group) and a reviewer.
- The campaign dashboard shows no warning about invalid reviewer emails.

## Next steps

- [User Access Review Overview](/user-manual/docs/user-access-review-overview)
- [Creating an Access Review Campaign](/user-manual/docs/creating-an-access-review-campaign)