Recertifying 4,200 Privileged Users in Six Weeks
Vantage Logistics has 9,400 employees and 1,100 contractors in CyberArk Identity, federated to Azure AD with SCIM provisioning from AD. Privileged access lives in 1,700 Safes in PAM, with membership granted mostly through 320 AD groups nested three levels deep. Last audit found 640 contractor accounts still active up to 90 days after contract end, 210 Safe memberships held by leavers, and 1,400 'Domain Admins' memberships that were never reviewed because the Safe owner had left the company. Recertification is a spreadsheet sent twice a year, and completion is 58%. The IGA team wants to run campaigns in CyberArk Identity Governance; the PAM team insists Safe membership should be reviewed in PAM, not IGA. The auditor defines 4,200 users as privileged and in scope. The quarterly campaign must finish in six weeks.
1. Resolve the ownership dispute and define a certification scope that can actually complete in six weeks.
Read the worked answer
The dispute is framed wrongly. The deciding factor is not which team owns the tool; it is that the review must be performed against the system that holds the authoritative entitlement, by a reviewer who can judge the business need. Safes hold the entitlement. Identity Governance can be the campaign engine and the evidence record, but only if it ingests PAM Safe membership and owner data; if that integration is not ready, run cycle one in PAM and migrate the workflow to IGA once the data feed is proven. Trying to launch an IGA campaign against incomplete PAM data will produce a defensible-looking report that is factually wrong.
Scope: 4,200 users reviewed individually in six weeks is not achievable and would push reviewers into rubber-stamping. Reduce the unit of review:
- Where membership derives from an AD group, review the group membership once, not 320 times per Safe.
- Review manual and exception memberships individually; those are the ones nobody has justified.
- Prioritise tier-0 in cycle one: the 1,400 Domain Admins memberships plus all Safes containing domain or cloud-admin credentials. Defer application-level Safes to cycle two.
Pre-work that must happen before launch: reassign every orphaned Safe to a live owner. The 1,400 unreviewed memberships exist because ownership was never transferred, and a campaign that routes them to nobody will either stall or auto-approve. Set auto-revoke on no response, with a grace period, and communicate it in advance.
2. Explain how 640 contractors stayed active 90 days past contract end and 210 leaver memberships survived, given AD, SCIM, and PAM are integrated. What would you change?
Read the worked answer
Both symptoms point at the same architectural gap: the joiners-movers-leavers pipeline terminates at the identity layer and never reaches the entitlement layer, and the authoritative source of a contract end date is not wired into anything.
Contractors: SCIM from AD deprovisions a CyberArk Identity user when the AD account is disabled. If the contract end date lives in a procurement system or a spreadsheet and nobody disables the AD account, nothing downstream fires. Some contractor accounts are also likely created directly in CyberArk Identity or held in a separate OU outside the sync scope, so they are invisible to the pipeline entirely. Fix: make HR or procurement the authoritative source for contract end, set an expiry attribute on the identity, and auto-disable on the date regardless of manager action. Reconcile monthly between the contractor roster and active accounts.
Leavers: disabling the vault user does not necessarily remove Safe membership rows that were created manually or through nested groups. Nested groups compound this - a user removed from a leaf group can retain access if an intermediate group remains a member, and leaver reports that inspect direct membership miss it. Fix: minimise manual Safe membership in favour of group-derived and attribute-driven membership, replace static membership with dynamic rules based on department, role, and location where possible, and run a monthly reconciliation of effective Safe access against the HR leaver list rather than direct membership rows.
Both fixes shrink future campaigns, which is the real leverage: certification is expensive because provisioning is imprecise.
3. Completion sits at 58%. Give the campaign design changes you would make and the trade-offs you accept.
Read the worked answer
Low completion is usually a design failure, not a reviewer attitude problem: too many items per reviewer, no decision support, no deadline consequence, and no executive air cover.
Changes:
- Cap items per reviewer at a number a person can genuinely assess in the window - a few hundred, not thousands. Split large Safes across multiple reviewers by department.
- Pre-populate recommendations. Items with no activity in the period, or matching a role baseline, arrive as suggested revoke or keep. Human attention goes to exceptions and outliers. This is the biggest lever on both time and quality - but accept that it can mask a legitimate low-frequency access need, so give reviewers a visible 'last used' and 'granted by' field.
- Route by accountability: manager for business need, application or Safe owner for technical appropriateness. Two questions, not one, on separate items.
- Enforce the deadline. Reminders at day 10, 20, and 30; auto-revoke at day 35 with a grace period for restoration on appeal. Communicate it before launch and get it endorsed by the executive sponsor.
- Publish a live completion dashboard by department. Visibility moves completion more than email volume.
Trade-offs to state openly: auto-revoke will occasionally remove access someone needed, generating short-term tickets - that is the intended pressure to fix provisioning. Pre-populated recommendations reduce reviewer workload but require the underlying usage data to be trustworthy, so validate it before the first cycle. And a six-week cycle on a reduced scope produces a defensible result; a six-week cycle on 4,200 individual reviews produces a signature, not an assessment.