Discover what your team uses.
Combine connected applications, OAuth grants, supporting email activity, and browser observations. Keep the evidence behind each application visible as your inventory grows.
Apps & access
Review user access. Retain the evidence.
Collect verified accounts, decide what should stay or change, and track required changes in one review. Keep recorded decisions, revocation requests and checks in the source application distinct.
Access reviewAM
Alex MartinFinance · employee
JT
Jamie TaylorFormer contractor
SL
Sam LeeMarketing · employee
Decisions recorded. Actions ready to follow up.
Trusted by 190+ organizations
An app list is only the beginning.
Knowing a tool exists does not tell you who has access, why they need it, or whether a permission should remain. Elba connects application discovery to the evidence and people behind the decision.
Bring the right risks into focus.
Investigate risky permissions, unapproved AI tools and application ownership. Assign an owner and record your organization’s usage policy. For CVE and breach findings, check the source verification, collection date and actual coverage; historical findings alone do not establish recent monitoring coverage.
Keep decisions and change evidence together.
Record maintain, revoke or role-change decisions and follow the required changes. Retain a completed review’s PDF summary and detailed CSV alongside your checks in the source application.
From visibility to action
Take one application through an access review.
Define the scope, make each decision and check the changes in the application.
Verify the accounts to review.
Use accounts from a connected source or validate a CSV or screenshot import with the application owner. Browser observations help identify tools to investigate; they do not become account rows or revoke actions.
Decide what access is still needed.
Set the application scope, deadline and reminders. Review the business need, then record maintain, revoke or role-change decisions for the verified accounts. Assess finer permissions in the source if your account evidence does not represent them.
Apply and check the required changes.
Request revocation through Elba where the integration and account support it. Make other changes in the source application. Check the actual result there before marking a change done; Elba does not independently verify removal.
Demo agenda
What to check in an access review demo.
Choose a representative application with our team. Walk through its account evidence, a review decision and the required-change record without changing your production access.
- Check which accounts are verified, which remain unmatched and which observations still need verification.
- Record an owner-informed maintain, revoke or role-change decision with a defined review scope.
- Inspect a supported revocation request and the manual path for an unsupported account or role change. Keep the request separate from source-side verification.
- Read a completed review’s PDF summary and detailed CSV. Identify decisions, requests, manual completion declarations and evidence still needed from the application.
Your tools. A connected view.
Make your stack part of the solution.
A closer look
The questions that matter.
Does browser usage prove that someone has an account?
No. Elba labels browser observations separately. Access reviews use connector-confirmed accounts or an authoritative import. Browser-only usage cannot create a revoke action or a review decision.
Can Elba review an application without a connector?
Yes. Import accounts from a CSV or screenshot and validate the results with the application owner. You can then record decisions and track changes made in the application.
Are access changes fully automated?
No. Access Review revocation requests are human-triggered and depend on the integration and account. Elba does not independently verify removal. Check the result in the source application before marking it done. Role changes are made in the source; Okta provides read-only context.
What evidence can we retain after a review?
Organization owners and administrators can download a PDF summary and detailed CSV from a completed review. They record the scope, decisions and required-change evidence. A revoke request or manual completion declaration is not verified removal, and the exports are not a compliance certification. Keep supporting source evidence alongside them.
Connected by design
One risk rarely lives alone.
Evaluate your next access review in Elba.
Walk through one application’s verified accounts, review decisions and required changes. Check the source-specific limits and the evidence you can retain before choosing your review process.