User access reviews (UARs)
Where to record logical access reviews in Noru, what evidence to retain, and which review steps happen in your source systems.
Can I perform a logical UAR in Noru?
Noru supports recording your review and linking its evidence to the Logical Access Review control. It does not currently provide a dedicated access certification campaign, a per-account approve/revoke queue, or automatic access removal. A control with that name describes the requirement; it is not a separate UAR application.
Where to find it
- Open Controls and search for Logical Access Review.
- Open the control. Review its guidance and existing linked evidence.
- Collect the relevant account and permission lists from your source systems. Connected directory data can support the review, but does not by itself establish that every application's permissions have been reviewed.
- Have the responsible reviewers record retain/change/remove decisions and carry out access changes in the source systems.
- Upload the reviewed list, decisions, follow-up results and sign-off as evidence, then link it to this control. Record context and the next review in Notes and your review schedule.
The People directory provides personnel context. It is not a substitute for an application-by-application entitlement review.
Asking an agent
Ask: “Find the Logical Access Review control and its linked evidence.”
checkGuidanceRequirements understands UAR, UARs and user access
review as searches for that control. An agent should distinguish evidence
that a review occurred from functionality provided by Noru, and should not
invent a UAR navigation path.
Last updated on