MSP User Access Review Template: A Quarterly Check for Client and Technician Access

A user access review is a scheduled check where someone at the client confirms that every account in their systems still belongs to a current person, still needs the access it has, and is protected the way the client's policy says it should be. The MSP prepares the list. The client owner makes the keep or remove call. Both sign the result.

Many small clients have never done one. Accounts pile up through hires, role changes, contractors, shared mailboxes, and the vendor who needed admin rights for one weekend in 2023. Nobody notices until a cyber insurance renewal asks how often access is reviewed, a HIPAA or FTC Safeguards client gets an audit letter, or a former employee's login shows up in a sign-in log.

This template is for the vCIO or account lead who runs that review. It covers which systems to include, a table for checking each account, how to review your own technicians, how often to run it, and the sign-off log that proves it happened. If the client is leaving your MSP, the client offboarding checklist covers handing admin access over cleanly. This page is the recurring check you run while you still manage them.

Why clients get asked for access reviews

Access review shows up as a written requirement in most of the frameworks small and midsize clients run into.

• FTC Safeguards Rule. Section 314.4(c)(1) of 16 CFR 314.4 requires covered financial institutions to implement and periodically review access controls, limiting authorized users to the information they need for their duties. The same section requires MFA for anyone accessing an information system. If the client already has a written program, the MSP WISP template shows where the review belongs.
• HIPAA Security Rule. 45 CFR 164.308 requires covered entities to regularly review records of system activity, such as audit logs and access reports. It also lists procedures to establish, document, review, and modify a user's right of access.
• CIS Controls. CIS Control 5 covers processes and tools to assign and manage credentials for user accounts, administrator accounts, and service accounts.
• Cyber insurance. Many renewal applications ask whether admin accounts are separate from daily accounts, whether MFA covers remote and admin access, and how often access is reviewed. The cyber insurance requirements guide covers the controls insurers ask about most.

None of these sources gives you a form. They describe the outcome: access is limited, checked on a schedule, and the check is recorded. The template below turns that into a session the client can finish in about an hour.

Decide which systems are in scope

Start with every system where an account can reach client data or change client settings. For a typical small business that means:

• Identity. Microsoft 365 or Google Workspace users, guests, shared mailboxes, and admin role assignments.
• Line-of-business apps. The EHR, accounting system, practice management tool, or CRM, where the vendor often controls the admin console.
• Finance and payroll portals. Banking, payroll, and payment processors. These are high value and easy to forget, because the client manages them and the MSP never sees them.
• File sharing outside the main tenant. Any separate cloud storage, client portals, or e-signature accounts.
• Remote access and VPN. Firewall VPN users, remote desktop gateways, and any remote support tool with unattended access.
• MSP tools that touch the client. Your RMM, PSA client portal, password manager, backup console, and documentation platform. These hold technician accounts with broad rights, so they get their own section below.
• Physical and building systems. Door access, alarm codes, and camera systems, if the client wants them in the same review.

Write the list down per client and keep it. Next quarter you review against the same list, and anything new gets added at onboarding instead of discovered at audit. The new client onboarding checklist is a good place to capture it the first time.

Pull the account list before the meeting

The review goes faster when the MSP brings a complete list and the client only has to decide.

For Microsoft 365, the Entra admin center can show each user's last interactive sign-in time as a column in the user list. Microsoft's guide to managing inactive user accounts explains the options. Pulling last sign-in through Microsoft Graph requires Entra ID P1 or P2, the value can lag by up to a day, and Microsoft calls 90 to 180 days a reasonable window for treating an account as inactive. Pick one window per client and write it in the policy.

If the client has Microsoft Entra ID Governance or Microsoft Entra Suite, the built-in access reviews can run recurring reviews of group membership, app access, and guest users, and send them to the owner to approve or deny. Most small clients don't have that license. The table below works either way, and it covers the systems outside Microsoft that the built-in feature never sees.

For every other system, export the user list from the admin console or take a screenshot of it. Record the date you pulled it.

User access review table

Use one table per system. Each row is one account.

Rules for filling it in:

1. Every account gets a named person or a named owner. A shared or service account needs a person who answers for it. If nobody claims an account, the default decision is disable, then delete after a set wait if nobody complains.
2. Admin access gets its own row. If someone holds admin rights, list the admin role separately from their daily account so the client sees how many admins they really have.
3. Inactive accounts get flagged automatically. Anything past the client's inactivity window goes to the owner with a default of remove.
4. MFA gaps are findings. An account without MFA where the policy requires it goes on the finding list even if the owner keeps the account. The Microsoft 365 Conditional Access baseline covers how to close that gap in the tenant.
5. The client decides, the MSP executes. The owner marks Keep, Change, or Remove. Your team makes the change and records the ticket number.

Review your own technician access

To every client, your MSP is one of the accounts with the most reach. A review that skips your own access leaves out some of the widest access on the list.

Check these every quarter for each client:

• Partner admin relationships. For Microsoft 365, confirm which granular delegated admin (GDAP) relationships exist, which roles they grant, and which of your security groups hold them. Microsoft's GDAP FAQ notes that a relationship lasts at most two years, so record each expiry date and decide on renewal before it lapses.
• Named technician accounts. Every technician with access to the client should have a named account in your RMM, PSA, password manager, and backup console. Remove accounts for staff who left, and drop access for anyone who moved off the client.
• Break-glass and local admin accounts. List them, confirm who holds the credentials, and confirm the password was rotated after the last person with access left.
• Remote access tools. Confirm unattended access is limited to the devices that need it and that sessions are logged.

Put these rows in the same table with "MSP" in the role column. The client sees exactly who on your side can reach their systems, and you have a record when a prospect or insurer asks how you control your own access. If the client also uses a vendor risk assessment, this section doubles as your answer to their questions about you.

Set the cadence by risk

One schedule for every system wastes time on low-risk accounts and leaves high-risk ones too long. A workable default:

Quarterly lines up with the QBR, so many MSPs run the access review as a standing section of the quarterly business review. The client owner is already in the room, and the findings feed straight into the roadmap discussion.

Example timing, for illustration only: a client with 25 people and 6 in-scope systems has about 150 account rows. If the MSP prepares the export ahead of time and the owner spends 20 seconds on each row, the decision part of the meeting takes 50 minutes.

Sign-off log template

The table records the decisions. The sign-off log records that the review happened, who ran it, and what changed. This is the page an auditor or insurer asks for.

Keep the completed tables and the signed log together, by quarter, in the client's documentation. When an exception is accepted, give it an expiry date so it comes back up at a later review.

Price it as a recurring service

A quarterly access review takes prep time, meeting time, and change work every quarter. Put it on the agreement as a line item in the compliance or vCIO tier, or as a fixed quarterly fee per client.

Price it from your labor: the export and prep, the review meeting, and the changes that follow. Clients with regulated data and more systems get more rows and more work. The MSP compliance pricing guide walks through packaging compliance work so the review is visible on the agreement and renews with it.

Track findings and the follow-up work

First reviews tend to turn up the same findings: admins without separate accounts, MFA gaps, guests nobody remembers, and former staff with active logins somewhere outside Microsoft 365. Each one needs an owner, a severity, and a next step, or it shows up again next quarter.

Scopable's GRC workflow keeps those findings with the client record. You attach a framework such as HIPAA, SOC 2, PCI-DSS, or CIS Controls to the client, track open gaps by framework, severity, and status, and turn a finding into a roadmap item, accepted risk, scoped remediation project, or quote. With Microsoft 365 connected and each tenant mapped to its client, Scopable syncs users and license assignments under that client and reads MFA status where permissions allow. Legal and audit judgment stays with the client's counsel and auditor. The findings, the decisions, and the follow-up work stay in one place, so next quarter's review starts from what changed.

To run your next access review against the client record, start Scopable for free.