Every Monday morning, someone on your team opens a spreadsheet named something like access_tracker_FINAL_v3.xlsx and quietly prays it’s still accurate.
Let me be blunt: it isn’t. And you already know that, because you’re the one fielding the Slack messages about a contractor who still has admin rights eight months after his contract ended. Manual access management doesn’t fail loudly. It fails in small, invisible ways that only surface during an audit you weren’t ready for.
So here’s the promise. By the end of this, you’ll understand why permission requests overwhelm small IT teams, what to look for in user access management software, and a five step process you can run this week without buying anything. No procurement cycle required.
The real reason tickets pile up
It’s not that your IT team is slow. It’s that they’re the only people allowed to say yes.
Think about what actually happens when a marketing coordinator gets promoted. She needs access to a campaign analytics dashboard, loses access to the old content calendar, and picks up approval rights for ad spend. That’s three changes from one person, in one week. Multiply it by a growing headcount and you’ve built a full time job out of clicking checkboxes.
The deeper problem is ownership. When a new hire starts, HR knows. When someone switches teams, their manager knows. When a contractor leaves, the agency knows. But none of that knowledge automatically reaches Active Directory, so IT becomes the human router for every department’s change of plans.
Managers also have no visibility. Ask your head of sales which of her reps can still see the old CRM export and watch her face. She genuinely doesn’t know, and that’s not a character flaw. It’s what happens when permission data lives in a tool she never opens.
What role based access control actually fixes
There are three ways teams handle permissions, and only one of them scales past about forty employees.
- Manual assignment. Someone approves every request by hand. Fine at fifteen people, painful at fifty, dangerous at two hundred.
- Role based access control. Permissions attach to a job role, not a person. Move someone into the “Support Tier 2” role and their access updates with it.
- Automated provisioning. Your HR system is the source of truth. A new hire record triggers directory access automatically, and a termination record revokes it the same day.
I’d pick role based access control first, every time, even if you never buy a tool. It’s the mental model that makes everything else possible. Once roles exist, an employee’s permissions become a property of their job instead of a pile of one off favors you granted in 2023.
Automated provisioning is the bigger lift and honestly overkill for a twenty person shop. But if you’ve got contractors cycling through every quarter, it pays for itself in the first audit.
The 5-step permission audit you can run this week
Before you shop, get a baseline. This takes a few focused afternoons and costs nothing but calendar space.
- Export every account. Pull the full user list from your directory and your core SaaS apps. Expect duplicates and ghost accounts. You’ll find both.
- List the top ten roles by headcount. Not every role. Just the ones where most of your people sit.
- Map current access to each role. For each one, write down what access a person in that role genuinely needs. You’ll spot three or four permissions nobody can justify.
- Mark every account with no active employment record. Contractors, former interns, that shared login the design team uses. Every one is a finding waiting to happen.
- Ask two managers to review their team’s list. Not all of them. Two. You want proof the process works before you roll it out company wide.
Save the output. It becomes your requirements document, and it’s far more persuasive to a vendor than a vague wish list.
The compliance pressure is real
You’re not doing this out of tidiness. Regulation and litigation both assume you can answer a simple question: who had access to this file on this date?
Under federal equal employment law, employers have a duty to keep personnel records confidential, and a tangled permissions structure makes that harder to prove. The U.S. Equal Employment Opportunity Commission is the agency that fields those complaints, and the first thing anyone asks for is a record of who could see what.
California’s courts have raised the stakes further by requiring businesses to maintain reasonable security procedures for personal information, as the California Courts system has summarized in its published guidance. A spreadsheet no one updates is not a reasonable procedure. It’s the exhibit.
How to choose without overbuying
Most small teams buy too much software for a problem they haven’t defined. Use this instead.
| What to check | Why it matters for a small team
|
| Directory sync | If it can’t read from your current directory, you’re maintaining two lists forever. |
| Role templates | Prebuilt roles cut setup time from weeks to an afternoon. |
| Revocation speed | How long after a termination does access actually disappear? Ask for the number. |
| Audit log export | You’ll need a clean CSV during your first real review. |
| Pricing model | Per user pricing punishes you for hiring, which is a strange thing to pay for. |
Run every candidate against that grid before the demo. Demos are built to impress you, not to reveal that revocation takes four hours to propagate.
Set a revoke deadline, not a review cycle
Here’s the piece most teams skip, and it’s the one that matters most.
Pick a specific deadline for every access decision, and put it somewhere a calendar can see. New hire request, two business days. Department transfer, same week. Termination, within one business day, without exception. The exact hours matter less than the fact that a number exists and someone owns it.
The reason this beats a quarterly review is simple. Nobody audits access with enthusiasm. Everyone answers a calendar reminder.
The National Institute of Standards and Technology has long argued that identity and access controls should be built into how a company operates rather than bolted on afterward, and the practical version of that advice is a deadline attached to a name.
One more thing. Write the deadline into your onboarding checklist, not a policy document nobody reads. The checklist is where work actually happens.
Start with the list you already have
You don’t need a platform to take the first step. Open the directory export, mark the accounts with no owner, and revoke them today. That’s one afternoon of work and it’s the single highest value hour you’ll spend on access control this quarter.
Do that once and the rest stops feeling abstract. The spreadsheet gets smaller, the audit questions get easier, and future you isn’t the one explaining why a former contractor could still see payroll files.
So which account are you revoking first?
