Automate user access reviews for apps without SCIM or an API
Stepwork pulls accounts from every app, including ones without SCIM, matches them to HR, carries out reviewer decisions, and files the evidence in Vanta.
- Use case
- User access reviews across every appInfoSec & Compliance
- Best for
- GRC Engineer, IT Manager, Security Lead
- Applications used
Okta
Workday
Internal tool
Vanta
Slack
- Business outcome
- Reviews that run monthly, not once a quarter
The problem
The review comes back every quarter, and so does the spreadsheet
- Export accounts and roles from every app without SCIM
- Paste each list into the access file template
- Match every account to someone in the HR system
- Chase reviewers until every app is signed off
- Remove flagged access by hand, one admin console at a time
- Screenshot each removal and upload it as proof
Systems
Accounts from every app in scope
Your identity provider and HR system say who should have access. Stepwork reads who does, app by app, through each admin console, including the apps with no SCIM and no integration, and hands the list to your compliance platform.
- Identity and HR: Okta, Microsoft Entra ID, JumpCloud, Workday, BambooHR, Rippling
- SaaS admin consoles: GitHub, Salesforce, Slack, AWS, Snowflake, Datadog, 1Password
- Apps without SCIM: Internal tool, On-prem app, Vendor portal
- Compliance platforms: Vanta, Drata, Secureframe
Example procedures
The whole review, card by card
One gathers every app's accounts and files them, one carries out what reviewers decide, and one closes leavers' accounts between reviews. Swap in Drata or Secureframe, or your HR system, above each one and the steps stay the same.
Monthly access review across every app without SCIM, filed in Vanta
On the 1st of the month Stepwork reads the apps in the review from Vanta, exports every account and role from each one, matches them to Workday, and uploads each app's access file to the review. Accounts with no active owner go to the reviewer first.
- Vanta
- Workday
- Internal tool
- Slack
Swap in your systemsThe steps stay the same. Only the screens change.
Monthly access review across every app without SCIM, filed in Vanta
Extraction
Read the apps in this review from Vanta
Scheduled · 1st of the month
Extracted variables
- app_name
- reviewer_email
Extraction
Read active employees from Workday
Extracted variables
- employee_list
Extraction
Read every account and role in the app
Input variables
- app_name
Extracted variables
- account_rows
Rule logic
Does every account match an active employee?
Input variables
- account_rows
- employee_list
Paths
- If an account belongs to someone who left, or to no one in WorkdayThen: Flag the accounts to the reviewer in Slack
- OtherwiseThen: Upload the access file to the review in Vanta
Execution
If any don't matchFlag the accounts to the reviewer in Slack
Input variables
- app_name
- reviewer_email
- account_rows
Output
- flagged_accounts
Execution
Upload the access file to the review in Vanta
Input variables
- app_name
- account_rows
Output
- upload_status
Summary
Sum up the review for the GRC team
Input variables
- upload_status
- flagged_accounts
Drag to explore · pinch to zoom
Step by step
- The review's apps come inStepwork reads the applications in this month's review from Vanta, with the reviewer for each. Each app is one pass through the loop.
- Stepwork reads who works hereIt reads every active employee from Workday once, so every app's accounts are matched against the same list.
- Each app gets exportedInside the solid frame, Stepwork signs in to the app's admin console and reads every account, its role, and its status. No SCIM, API, or integration is needed.Repeats: For each app in the review · 30 apps
- The rule matches ownersIf any account belongs to someone who left, or to no one in Workday, the run takes the top path. If every account matches, the file goes straight to Vanta.
- If any don't matchFlag the accounts to the reviewer in Slack
- If they all matchUpload the access file to the review in Vanta
Repeats: For each app in the review · 30 apps - The reviewer hears firstOnly when something doesn't match: the reviewer gets the unmatched accounts in Slack, so they decide with the facts in front of them.Only on this path: If any don't matchRepeats: For each app in the review · 30 apps
- The access file gets filedBoth paths meet here. The recorded flow opens the review in Vanta, picks the app, and uploads its accounts in the access file format.Repeats: For each app in the review · 30 apps
- The GRC team gets the pictureAfter the last app, the Summary card lists how many accounts each app had and which ones were flagged.
Field map
| From | To |
|---|---|
| Internal toolUsers: name, role, status | VantaAccess file: account name, role, status |
| WorkdayEmployees: work email, status | VantaAccess file: account ownerOr no owner, when nothing matches |
Revoke what reviewers decide and attach the proof in Vanta
Every weekday Stepwork reads the decisions reviewers made in Vanta. Each account marked to revoke is removed in that app's admin console, and the user list afterwards is attached to the review as proof.
- Vanta
- Internal tool
- Slack
Swap in your systemsThe steps stay the same. Only the screens change.
Step by step
- The decisions come inStepwork reads each decision reviewers made in Vanta since the last run: the app, the account, and keep or revoke.
- The rule picks the revokesInside the dashed frame, accounts marked to revoke take the path forward. Kept accounts need no change, so nothing else runs for them.
- If revokedRemove the account in the app's admin console
- OtherwiseKept accounts need no change
Repeats: For each reviewer decision · 14 decisions - The access gets removedThe recorded flow signs in to the app's admin console and removes the account, the same way an admin would, including in apps without SCIM.Only on this path: If revokedRepeats: For each reviewer decision · 14 decisions
- The proof gets capturedStepwork reloads the app's user list and saves a timestamped screenshot showing the account is gone.Only on this path: If revokedRepeats: For each reviewer decision · 14 decisions
- The proof gets filedThe recorded flow attaches the screenshot to that account in the review in Vanta, so the remediation evidence is there when the auditor looks.Only on this path: If revokedRepeats: For each reviewer decision · 14 decisions
- The reviewer hears backAfter the last decision, the reviewer gets a message in Slack listing what was removed and filed.Only on this path: If revoked
Field map
| From | To |
|---|---|
| VantaReview: account marked revoke | Internal toolUsers: remove access |
| Internal toolUser list after removal | VantaReview: remediation evidence |
Daily leaver check across every app without SCIM
Every morning Stepwork reads who Workday marked as terminated, looks each of them up in every app without SCIM, and closes any account still active, so access doesn't wait for the next review.
- Workday
- Internal tool
Vendor portal- Slack
Swap in your systemsThe steps stay the same. Only the screens change.
Step by step
- The leavers come inStepwork reads everyone Workday marked as terminated since yesterday. It only acts on people HR has already marked as gone.
- Each app gets checkedInside the solid frame, Stepwork signs in to each app without SCIM and looks the leaver up by email.Repeats: For each app without SCIM · 12 apps
- The rule finds open accountsIf the leaver still has an active account, the run goes on to close it. If the account is already closed, nothing else runs for that app.
- If still activeDeactivate the account
- OtherwiseAlready closed, nothing to do
Repeats: For each app without SCIM · 12 apps - The account gets closedThe recorded flow deactivates the account in that app's admin console, and the run record keeps the time.Only on this path: If still activeRepeats: For each app without SCIM · 12 apps
- The closures get listedAfter the last app, the Summary card lists each account that was closed, by person and app.Only on this path: If still active
- IT sees itThe list goes to IT in Slack, and it doubles as evidence that leavers lost access within a day.Only on this path: If still active
Field map
| From | To |
|---|---|
| WorkdayTerminations: work email | Internal toolUser search: emailOnce per app without SCIM |
| Vendor portalAccount status | SlackClosed accounts listOnly accounts that were still active |
Flows
The access review flows these procedures are built from
Each flow is one recorded export or change in one app. Procedures run them back to back on a schedule.
- Okta
Extract full user directory with status
Pages through the Okta user list and extracts name, email, status, and last login for every account into a table. - Okta
Extract users inactive 90+ days
Filters the Okta directory by last login, pages through results, and extracts accounts idle for 90 or more days. - Okta
Extract deactivations for evidence period
Extracts accounts deactivated in a date range with timestamps, as offboarding-control evidence. 
GitHubExtract org members with team memberships
Pages through org people and extracts each member with their team memberships and role.
Google WorkspaceExtract admin role assignments
Opens admin roles in Google Admin and extracts every account with delegated admin privileges and their role.- Slack
Extract guest accounts with channel access
Extracts all single- and multi-channel guests with the channels they can access into a table. 
AWSExtract IAM users with last activity
Extracts all IAM users with console last-sign-in and access-key last-used dates into a table.
SalesforceExtract users with Modify All Data
Extracts users whose profiles or permission sets grant Modify All Data and similar god-mode permissions.
1PasswordExtract vault access report
Iterates shared vaults and extracts each vault's members and permission levels into a table.- Vanta
Extract access review campaign status
Extracts the current access review campaign with completion status per reviewer. - Drata
Extract access review status
Extracts the current user access review with per-application completion status. - Slack
Deactivate expired guest accounts
Reviews guest accounts against their intended end dates and deactivates those past expiry. - Vanta
Upload an access file to a review
Opens the access review, picks the application, and uploads its accounts in Vanta's access file format. - Internal tool
Remove a user and capture the proof
Signs in to the app's admin page, removes the user's access, and saves the user list afterwards as a timestamped screenshot.
More procedures
More access procedures
Ready-made procedures in the Marketplace for reviews, leavers, and privileged access.
- 2 moreOkta · AWS · GitHub + 2 more
Quarterly access review evidence pack
Kicks off the quarter's access review by extracting Okta admin roles, AWS IAM MFA status, and GitHub membership, checking Vanta campaign status, and uploading the compiled evidence to close the review's document requests. - 1 moreRippling · Okta · Salesforce + 1 more
Offboarding verification audit
Weekly, extracts recent terminations from Rippling, verifies each against the Okta directory, and pulls Salesforce login history for terminated users to catch post-departure access, reporting violations with evidence. - Okta · Tailscale · Slack
Terminated-access nightly verification
Nightly, extracts the period's Okta deactivations, verifies no terminated user retains Tailscale network access by diffing the tailnet user list, removes any stragglers, and logs the verification for evidence. - Okta · Google Workspace · Slack
Stale account detection and suspension
Extracts accounts inactive 90+ days in Okta and 60+ days in Google Workspace weekly, posts the candidate list for manager confirmation, and suspends confirmed stale accounts with a record of each decision. 
1 moreOkta · Microsoft Entra ID · GitHub + 1 morePrivileged access change monitor
Weekly, extracts recent Okta admin role changes, Entra privileged assignments, and GitHub org audit admin events, diffs against the approved-admin baseline, and routes unexplained changes for review.
Why Stepwork
The same review, every app, every cycle
Calm runs its access review across about 50 applications with Stepwork, including Okta and the apps without SCIM. Stepwork is a deterministic agent platform: each export and each removal runs the steps you recorded, the same way every cycle. Every run records which accounts were read, which were removed, who decided, and when, so the evidence matches what happened.
Calm customer storyDeterministic agentsProcedures
Book a DemoFAQ
Common questions
The math
What a manual access review costs
Example volumes for a monthly review of 30 apps without SCIM or an integration. Swap in yours.
Illustrative estimate, not a quote. These are example volumes and typical hand times, not a customer's results. Your numbers will differ, and we can work them out with you.
| The manual task | Times a week | Minutes each | Hours a week |
|---|---|---|---|
| Export accounts and roles from an app | 7 | 20 | 2.3 |
| Match accounts to HR and fill in the template | 7 | 25 | 2.9 |
| Chase a reviewer for a decision | 10 | 5 | 0.8 |
| Remove an account and capture the proof | 6 | 12 | 1.2 |
- Hours a week
- 7.3
- Hours a year
- 364
- Of one full-time person
- 18%
Example volumes, not a customer's numbers. Minutes are the typical time to do each task by hand. Hours a year assume 50 working weeks.