User Access Management for Mid-Sized Companies (2026)

User access management is the set of processes that decides who can access which applications, data and functions, and that grants, changes, revokes and reviews those rights across the employee lifecycle. This guide is for IT leads and IT admins at mid-sized companies with 50 to 500 employees, whose access rights are now spread across Google Workspace or Microsoft 365 and dozens of SaaS applications.

In practice, that means assigning access by role when people join, adjusting or removing it the moment they move or leave, and being able to prove at any time that every permission is still needed. Under the EU's NIS2 directive, companies in the covered sectors must also put access control policies in place. SAP authorization design and large enterprises with a dedicated identity team are deliberately out of scope here.

What is user access management?

User access management (UAM) is the part of identity and access management that controls who may use which applications, data and functions, and that grants, modifies, revokes and reviews those rights from an employee's first day to their last. It answers the question every auditor asks: who has access to what, since when, and on what grounds?

The term is used loosely. Some vendors treat it as a synonym for identity and access management (IAM) as a whole. Others reduce it to the technical task of setting permissions inside each application, sometimes called permissions management or entitlement management. Others again describe it as a product category. A useful reference comes from Germany's Federal Office for Information Security (BSI): its IT baseline protection module ORP.4 defines authorization management as the processes required to assign, revoke and control rights, and groups it with identity management under the umbrella of IAM. The practical consequence: software is the tool, the process is the definition. A tool rolled out before the process is defined only automates the existing mess.

Definitions based on BSI IT-Grundschutz Compendium, Edition 2023, module ORP.4, consulted on 12 October 2026. Examples: Corma.

Our glossary entry on entitlement management inside applications explains the difference between a role and an individual permission in more detail.

Why does user access management in mid-sized companies now happen in SaaS?

Because a growing share of a mid-sized company's access rights no longer lives in Active Directory or on file servers, but in SaaS applications that business teams buy and administer themselves. Much of the guidance on user access management still revolves around directory groups, file shares and ERP roles. For a company with 150 people, the map looks different: an identity provider such as Google Workspace or Microsoft Entra ID, plus CRM, accounting, HR software, collaboration tools, developer platforms and AI assistants, many with their own admin roles and local accounts.

Published case studies from Corma customers between 70 and 400 employees show how large that estate is:

Method: figures as published in Corma case studies (published June and July 2026), consulted on 12 October 2026. "+" marks the minimum values stated in the case studies.

Two lessons stand out. First, the case studies already list 45+ to 80+ SaaS tools for companies of 90 to 280 employees, each with its own permission model. Second, the documented inventory can sit far below reality: at Satelia it was 160 applications instead of 30. Access that nobody knows about cannot be revoked or reviewed.

There is also a technical limit. Suspending a user in the identity provider only affects applications connected through single sign-on. Outside that perimeter, the following typically survive:

• local accounts in tools without SSO,
• shared logins, for example for social media or supplier portals,
• API tokens and integrations running on a person's behalf,
• guest and contractor accounts,
• admin rights that business teams granted inside their own tools.

Typical signs that access management is no longer keeping pace with the company: former employees still appear in SaaS user lists or invoices. Nobody can produce a complete list of the applications in use. Customers send security questionnaires asking about access reviews. People who change teams keep the rights of their old role. Or an ISO 27001 audit or a NIS2 assessment is coming up.

This is where a platform that combines discovery and control makes the difference. Corma surfaces the applications in use, including non-federated and browser-based tools, and manages access requests, reviews and joiner, mover and leaver events in one place. See how it works on the Corma identity governance and administration platform.

Which obligations apply to user access management in mid-sized companies?

Three frameworks matter most: the NIS2 directive for companies in the covered sectors, ISO 27001 for certified companies and their customers, and the security questionnaires that larger customers pass down their supply chain.

According to Article 2(1) of the NIS2 directive (EU) 2022/2555, the directive applies to public or private entities of a type listed in its Annexes I and II that qualify as medium-sized enterprises under the EU's SME definition, or exceed its ceilings, and that operate in the Union. Germany's BSI Act, which transposes NIS2 and has been in force since 6 December 2025, translates this into a threshold of 50 employees or more than EUR 10 million in both annual turnover and balance sheet total. A typical mid-sized company with 50 to 500 employees therefore sits squarely in scope, provided it operates in one of the listed sectors.

Article 21 requires essential and important entities to take appropriate and proportionate technical, operational and organisational measures to manage cybersecurity risks. Its paragraph 2 lists the minimum measures, including human resources security, access control policies and asset management (point i) and the use of multi-factor authentication or continuous authentication solutions (point j). User access management is how those policies become day-to-day reality, and how a company proves it.

Companies outside the listed sectors are affected indirectly. Germany's BSI Act, for example, explicitly requires covered entities to address supply chain security, including their relationships with direct suppliers and service providers (section 30(2) no. 4). In practice, that obligation reaches suppliers as security questionnaires and contract clauses, and questions on access control and access reviews are a standard part of them.

The table below translates the core requirements of user access management into the SaaS reality of a mid-sized company. It draws on NIS2 and on the BSI module ORP.4, a detailed public catalogue of access management requirements.

Mapping by Corma based on Directive (EU) 2022/2555, Articles 2 and 21, and BSI IT-Grundschutz Compendium Edition 2023, module ORP.4, consulted on 12 October 2026. Not legal advice: check whether your company falls under NIS2 against Annexes I and II of the directive and your national transposition.

Auditors check the same points even where NIS2 does not apply. When Satelia pursued ISO 27001 and SOC 2 certification, its external IT provider only delivered basic reports, without user permissions, role-based access or usage frequency. "Without having those details, we couldn't move forward with the ISO 27001 and SOC2 certifications," says Eriel Cruz, Technical Project Manager at Satelia. The Satelia identity governance case study shows how the evidence was built.

User access management best practices: a five-step process

Before a tool automates a process, the process has to be right. As Corma put it in a video published on 18 December 2025: "The risk is automating workflows that were already bad." The five steps below follow that logic and can be started with or without software.

Step 1: Inventory every application, account and owner

Start with a complete inventory: every application, including browser-based tools adopted without IT approval, every account in each application, whether the tool is connected through SSO, and a named owner in the business. Privileged accounts deserve particular attention: who is admin in which tool? Without this inventory, every further measure is patchwork, because the access documentation must reflect the actual state of rights. Full SaaS visibility that includes shadow IT delivers this baseline automatically and keeps it current.

Step 2: Define roles and standard permission profiles

Rights are assigned to roles, not to people. A pragmatic start works best for mid-sized companies: a baseline role for everyone, then one role per department, and only then specialist roles. Two principles apply throughout: least privilege and need-to-know. Rights beyond the standard profile are granted only with an extra justification and review. Incompatible duties, such as payment approval and supplier creation, belong in separate roles, a principle known as separation of duties.

Together, these roles form your access control policy, the written mapping of roles to applications and permission levels. It does not need to be perfect before it pays off. What matters is that every new application is mapped to a role when it is purchased, not at the next audit.

Step 3: What are a manager's responsibilities in access management?

Managers decide on access from a business perspective: they approve requests beyond their team's standard profile, report joiners, movers and leavers on time, and confirm during access reviews which rights their team still needs. IT executes, documents and monitors. This split of duties rarely fails for lack of goodwill. It fails because of the channel: requests by email get lost, and approvals in chat leave no trace. Self-service access requests with approval in Slack or Teams work better, because every decision is logged automatically.

Step 4: How do you revoke all access when an employee leaves?

By making offboarding trigger a fixed, ideally automated sequence that does not stop at the identity provider. Joining, moving and leaving form the identity lifecycle, often called joiner-mover-leaver, and offboarding is where you see whether that lifecycle is really under control. A complete offboarding covers:

1. suspending the identity provider account and ending active sessions,
2. deprovisioning applications connected through SSO or SCIM,
3. removing local accounts in applications without SSO one by one,
4. revoking API tokens, OAuth grants and personal integrations,
5. transferring files, shared folders and admin roles to a successor,
6. cancelling or reassigning freed-up licenses.

Internal moves are the underestimated half. Someone who changes teams and only gains new rights accumulates permissions over the years that nobody can justify any more. An account that survives offboarding becomes an orphaned account: access without an owner that nobody will miss during an attack.

Mrge shows how much work this process can absorb. For the Hamburg-based commerce advertising company with 150 employees, manual provisioning and deprovisioning was time-consuming. With Corma, Mrge has automated more than 60 on- and offboardings. "We are implementing Corma to automate our on/offboarding process as well as understanding our license situation throughout the company," says Thorsten Milhoff, Engineering Manager at Mrge, in the Mrge IT automation case study. Under the hood, this relies on automated provisioning for onboarding and offboarding.

Step 5: How often should user access be reviewed?

Germany's BSI requires regular reviews in module ORP.4 but does not set a fixed interval, while France's data protection authority CNIL recommends reviewing access rights at least once a year. For mid-sized companies, we recommend a risk-based rhythm: quarterly for admin rights and for applications holding sensitive data, such as finance and HR systems, and yearly for everything else.

A user access review works when it brings the decision to where the knowledge sits. Each manager receives the list of their team's rights, confirms or revokes, and every decision is stored with a date. Revoked rights are actually removed, not just noted. The outcome is a report an auditor can read without follow-up questions. Corma automates exactly this workflow with automated and compliant access reviews. Consulting firm Apgar, with 280 employees, uses them to automate its access reviews for ISO 27001.

Three best practices run through all five steps. First, tie offboarding to the HR event, not to a ticket someone has to remember to write. Second, name an owner in the business for every application, who decides on requests and reviews. Third, make exceptions temporary: someone who needs admin rights for a project receives them for a limited time instead of keeping them for good. Corma supports this with just-in-time access that reduces standing privileges.

Spreadsheet, identity provider or platform: which tool fits?

A spreadsheet is enough as long as one person knows every application. The native tools of your identity provider reliably control everything connected through SSO. An identity governance platform pays off as soon as access lives in applications outside SSO, reviews must be evidenced, or offboarding keeps leaving gaps.

In Microsoft environments, permissions are usually managed in Microsoft Entra ID and the Microsoft 365 admin center, through groups, roles and enterprise applications. In Google environments, the Google Admin console does the same job. Both reliably govern what is connected to them. Applications that are not connected, however, do not appear there as manageable applications, and that is exactly where accounts are left behind at offboarding.

Assessment by Corma, October 2026. The scope of native tools depends on the license and configuration of each identity provider.

The platform does not replace the identity provider, it builds on it: the identity provider authenticates, while the governance layer, often called access governance, decides who should have what and provides the compliance evidence. For a vendor comparison including SailPoint, Saviynt, Okta Identity Governance and others, see our overview of the best IGA solutions for mid-market companies.

How Corma automates user access management for mid-sized companies

Corma is a European platform that combines SaaS management and identity governance, built for companies with 50 to 500 employees. It covers the five steps of this guide in one system:

• Inventory: Corma detects federated, non-federated and browser-based applications and assigns owners to them.
• Joiners, movers, leavers: zero-touch provisioning driven by your HR system and identity provider, such as Google Workspace, Microsoft Entra ID, Okta or JumpCloud, with agents that also act on applications without an API.
• Requests: a self-service app store for employees and approvals directly in Slack or Teams.
• Reviews: automated access reviews with audit-ready PDF and CSV reports.
• Trust: EU data residency, ISO/IEC 27001:2022 certification, and recognition in the Gartner Magic Quadrant for SaaS Management Platforms for the second consecutive year in 2026.

According to Corma, onboarding for a mid-sized company is typically completed in under a month. Two customers describe what that means in day-to-day operations:

Frequently asked questions about user access management

What is the difference between user access management and entitlement management?

User access management covers the processes for granting, modifying, revoking and reviewing access rights. Entitlement management refers to the technical upkeep of individual permissions inside an application. Access management decides who may do what, while entitlement management applies it in each system.

What is an access control policy?

An access control policy is the written rule set defining which roles or people receive which rights in which systems, and who approves them. NIS2 Article 21(2)(i) lists access control policies among the minimum cybersecurity measures for the entities it covers.

What types of access rights are there?

Security frameworks such as Germany's IT baseline protection distinguish physical access to premises, access to IT systems and access to data and functions. Within an application, access rights typically range from read to edit to administration.

Does NIS2 apply to mid-sized companies?

Yes, if the company operates in a sector listed in Annex I or II of the directive and qualifies at least as a medium-sized enterprise under the EU definition. Germany, for example, sets the threshold at 50 employees or more than EUR 10 million in both annual turnover and balance sheet total.

Who is responsible for user access management?

Managers decide from a business perspective who needs which rights, and IT executes and documents. In Germany, section 38 of the BSI Act additionally requires the management of covered companies to implement the cybersecurity risk-management measures and oversee their implementation.

How much does user access management software cost?

It depends on the number of users and the features required. Corma offers a free Freemium tier and publishes the per-user starting prices of its paid plans on the Corma pricing page. Automated access reviews and on- and offboarding are part of the Pro plan, priced on request.