User Access Review Software: How to Automate Reviews and Compare C1, Zluri, Lumos and Corma

Written for IT and security leads at 50 to 1,000-employee companies preparing an ISO 27001, SOC 2 or NIS2 audit, not for enterprises governing SAP-scale identity estates.

User access review software is a tool that collects who has access to what across your identity provider and SaaS apps, routes each entitlement to the right reviewer, and records every keep or revoke decision as audit evidence. Among the four tools most often shortlisted in 2026, C1 (formerly ConductorOne) and Lumos are identity security platforms that extend to AI agents and very large programs, Zluri adds a SaaS management module to its identity security platform, and Corma combines SaaS discovery with access reviews and hosts data in the EU. For a mid-market team, the deciding factors are coverage of apps outside single sign-on, where review data is hosted, and whether a revocation actually removes the access.

Last updated: September 30, 2026. Vendor facts were checked on each vendor's website on that date.

What is user access review software?

User access review software is a governance tool that automates the periodic check of who can reach which application, so that every permission still matches the person's current job. It replaces the spreadsheet export that managers receive once a quarter, scroll through, and approve in bulk.

The process goes by several names. Vendors and auditors also call it access certification, access recertification, entitlement review or account attestation. The mechanics are the same in every case:

• Collect access data from the identity provider (Google Workspace, Microsoft Entra ID, Okta, JumpCloud), the HRIS and the SaaS applications themselves.
• Assign reviewers by rule: the line manager for standard access, the application owner for sensitive systems.
• Capture decisions (keep, revoke, modify) with a timestamp and the reviewer's name.
• Execute revocations in the target app instead of opening a ticket.
• Produce evidence an auditor accepts: who reviewed what, when, and what changed.

The goal is least privilege over time. Without regular reviews, people accumulate rights as they change teams, a pattern known as privilege creep, and leavers keep accounts in apps nobody connected to single sign-on. Those excessive permissions are what turn a phished account or an insider threat into a data breach.

Which user access review software fits a mid-market team: C1, Zluri, Lumos or Corma?

For a company of 50 to 1,000 employees, Corma and Zluri sit closest to your size because both also manage SaaS licences and spend, while C1 and Lumos are identity security platforms whose scope extends to very large programs, AI agents and non-human identities. The table compares the four on what each vendor states publicly.

Transparency note: we build Corma. Every fact about C1, Zluri and Lumos below links to that vendor's own website, checked on September 30, 2026, so you can verify it before a demo.

C1 (formerly ConductorOne): for large programs that also govern AI agents

C1 changed its name on April 6, 2026. Its announcement reads: "Today, ConductorOne becomes C1.ai", and many comparison pages still list it under the old name. Access reviews live in the C1 Comply module, next to separation of duties (SoD) conflict detection and remediation. The platform also sells an LLM gateway, an MCP gateway and a credential vault, which tells you who it is built for: security teams that govern humans and AI agents at scale.

Watch for: C1 also markets to small and mid-size businesses, but its platform bundles far more than reviews, so ask for a quote scoped to the Comply module. C1's current commercial deployments run in the US environment: if you need EU hosting, request the EU tenant in writing.

Zluri: for teams that want reviews and SaaS spend in one place

Zluri describes itself as an identity security platform, with identity governance, identity security posture management and a SaaS management module for discovery, spend and renewals. Its access review offer highlights recurring templates, contextual risk insights and closed-loop remediation, and its trust center lists SOC 2, ISO 27001 and ISO 27701.

Watch for: Zluri's trust center lists AWS in the United States among its subprocessors, and its privacy policy states that personal information it collects "is stored and processed in India, or where we or our partners, affiliates, and third-party providers maintain facilities". If EU residency is a requirement, get the data processing terms in writing. Our detailed Corma vs Zluri comparison goes further on the SaaS management side.

Lumos: for enterprises that want agent-driven reviews

Lumos serves companies "from fast-scaling brands to global enterprises with 100,000+ employees" and runs reviews on entitlement-level data across the IdP, HRIS, ITSM, SaaS, cloud and on-prem systems. Its AI agent, Albus, validates review steps and produces reports formatted for SOC 2, SOX and ISO 27001. Its trust center lists SOC 2 Type II and ISO 27001.

Watch for: Lumos publishes no price, and its trust center lists AWS in the USA as its cloud infrastructure subprocessor, so pricing and data location both need to be settled in the sales cycle. See the Corma vs Lumos comparison for a side-by-side on scope.

Corma: for mid-market teams that need discovery, reviews and EU hosting together

Corma is a European licence and access governance platform that pulls access data from all your SaaS apps and pairs reviews with SaaS discovery, including a browser extension that finds apps never connected to single sign-on. Data sits in AWS data centers inside the EU. It is the only one of the four to publish an entry price on Corma pricing: Essential starts at €3 per user per month on annual terms for visibility and finance, and automated access reviews come with the Pro plan, quoted after a demo call.

Where it fits less: identity programs of tens of thousands of users that need separation-of-duties rules inside an ERP such as SAP are better served by enterprise IGA suites.

Does EU data residency still set vendors apart?

Partly. C1 now offers an EU tenant, so "EU hosting" alone no longer separates European and US vendors. What still separates them is whether EU hosting is the default, whether it covers support access and subprocessors, and whether the vendor states it publicly.

Here is what each vendor publishes. C1 describes three hosting environments, including a Commercial EU option where "C1.ai tenant data held in the EU. Runs in AWS Frankfurt, with Ireland for disaster recovery." Zluri's trust center lists AWS as a United States subprocessor, and Zluri adheres to the EU-U.S. Data Privacy Framework for transfers. Lumos's trust center lists Amazon Web Services in the USA as its cloud infrastructure subprocessor, and its privacy policy covers transfers outside the EEA. Corma's security and hosting page states that web servers and databases "run on servers in secure data centers inside the European Union".

Access review data is sensitive in itself: it lists every employee, every app and every permission, which is a map of your attack surface. That is why the hosting question belongs in the shortlist, not in the contract review. None of the five guides that rank best for "user access review software" mentions data residency at all, so buyers rarely see it until procurement asks.

Ask every vendor these five questions in writing:

1. Where is tenant data stored by default, and can it be pinned to the EU at no extra cost?
2. Which subprocessors handle review data, and in which countries?
3. From which countries do support engineers access customer data?
4. Which transfer mechanism applies to any non-EU processing (standard contractual clauses, EU-U.S. Data Privacy Framework)?
5. Can you export the full evidence trail, with decisions and timestamps, if you leave?

What does good access review software automate?

Good access review software automates everything except the decision: data collection, reviewer routing, reminders, revocation and evidence. Many access review tools are reporting dashboards that list entitlements and leave the hard work to you. Score vendors against this checklist.

Closed-loop remediation deserves extra attention. Flagging access is not removing it, and a revocation that turns into a forgotten ticket is how orphaned accounts survive deprovisioning. Ask each vendor to show a revoke click removing a real account during the demo.

Why do access reviews miss apps outside your identity provider?

A review can only certify accounts it can see, and an identity provider only sees the apps connected to single sign-on. Everything else, from tools bought on a company card to free tiers and AI assistants opened in a browser, sits outside the campaign, and unauthorized access there goes unnoticed. You do not need to wait for a gap to appear: if your review covers only SSO-connected apps, the gap already exists.

The size of that gap is usually a surprise. Satelia, a Bordeaux healthtech company that remotely monitors patients with chronic heart disease, needed a clear and auditable view of its SaaS tools to obtain ISO 27001 and SOC 2 certifications. Its manual reports listed 30 applications. Corma surfaced more than 160, over five times as many. That visibility satisfied the certification requirements and also exposed overlapping subscriptions, such as Notion, Google Drive and Confluence used for the same job.

At Apgar, the trigger was shadow IT and shadow AI accessed through browsers. Corma now detects those apps, automates licence optimization and runs the access reviews the company needs for ISO 27001.

None of the five guides that rank best for this query explains that a campaign only covers SSO-connected apps; shadow IT appears there only as a vendor feature. Yet this is where a SaaS management and discovery platform changes the result of a review: the campaign starts from the real list of apps, not the list IT connected.

How do you automate user access reviews and certification campaigns without rubber-stamping?

You automate the six steps a reviewer would otherwise do by hand: inventory, ownership, scoping, contextual review, remediation and evidence. Rubber-stamping stops when reviewers see last login, role and recent changes next to each entitlement, and when a revoke click removes the access instead of opening a ticket.

The pressure is growing because permissions multiply faster than teams can check them. Corma co-founder and CEO Héloïse Rozès put it this way in December 2025: "the risks of data leaks and access abuse increases every day with the rise of Shadow AI and the overall permission sprawl." A 400-row spreadsheet with no context cannot keep up with that; a structured campaign can.

An access certification campaign is a scheduled, scoped review in which reviewers attest to a defined set of entitlements. Here is the access review process the best software encodes:

1. Inventory access. Build a complete, current list of users and entitlements across every system, including SaaS apps outside your identity provider.
2. Define ownership. Name who attests for each resource: the line manager for standard access, the application or data owner for sensitive systems.
3. Scope the campaign. Choose the population and the cadence, separate privileged access, and decide which events (role change, transfer, departure) trigger a targeted review.
4. Review with context. Reviewers see last login, role and changes since the last review cycle, then keep, modify or revoke. Reminders chase anyone who has not answered.
5. Remediate and verify. Revocations are executed in the target app and confirmed, not just logged. This is the step manual processes skip most often.
6. Document and sign off. The tool stores the audit trail (reviewer, decision, timestamp, remediation) and the formal certification. This is the file you hand to the auditor.

Software earns its budget by running steps 1, 3, 4, 5 and 6 on its own, and by turning step 2 into a rule instead of a spreadsheet someone maintains by hand. Three campaign types cover most needs: a periodic campaign on all access, a tighter campaign on privileged accounts, and event-based reviews when someone moves or leaves.

What should be in place before you automate access reviews?

Automation amplifies your processes, good or bad. A reviewer on Gartner Peer Insights from a manufacturing company made the point in July 2026: the tool delivers most when system ownership, role definitions, access approval and offboarding are already disciplined, and role mapping needs care before automated decisions can be trusted. That matches what we see in rollouts. Check five things first:

• An owner per application, named in the tool, who answers for sensitive access.
• A source of truth for roles, usually the HRIS, so department, manager and role-based access control (RBAC) rules stay current.
• A written approval rule for who can grant what, so reviewers know the baseline.
• An offboarding path for non-SSO apps, because revocations there often need an API or a task.
• The evidence format your auditor accepts, agreed before the first campaign rather than after.

How often should you run user access reviews?

Review privileged and sensitive access every quarter, standard SaaS access every six to twelve months, and trigger an extra review at every role change or departure. Outside the financial sector, no EU regulation fixes the interval, so write your cadence into your access control policy and follow it.

Ranking guides disagree on this point. SecurEnds says organizations "should perform user access reviews at least quarterly", while Ping Identity lists quarterly, bi-annual or annual reviews as common practice. The primary texts settle it, and neither guide mentions the one text that sets numbers.

• DORA sets intervals for financial entities. Article 21 of the DORA technical standard, Delegated Regulation (EU) 2024/1774, requires the "update of access rights where changes are necessary and at least once a year for all ICT systems, other than ICT systems supporting critical or important functions and at least every 6 months for ICT systems supporting critical or important functions". Smaller entities under the simplified regime (Article 33) must review access rights "periodically".
• NIS2 sets none. The NIS2 Directive requires "access control policies" in Article 21(2)(i) without an interval.
• The CNIL recommends a minimum. France's data protection authority, the CNIL, advises a regular review of access authorizations "at least annual" (our translation). This is guidance, not law.

So quarterly is good practice for high-risk access, not a general legal requirement, and "annual is enough" is wrong for any DORA-regulated system that supports a critical function.

Which regulations and audit frameworks expect access reviews?

For regulatory compliance, ISO 27001, SOC 2, NIS2, DORA and GDPR all expect access to be controlled and checked over time, but only DORA fixes review intervals, and only for financial entities. The table shows what each text actually asks.

One nuance matters for EU buyers. Some vendor guides, such as this Lumos article, state that GDPR requires organizations "to regularly validate and document user access". The regulation's text is narrower: it asks for a process that regularly tests the effectiveness of security measures. Access reviews are one of the strongest ways to evidence that process, but GDPR never names them. US frameworks such as SOX and HIPAA appear in many guides too; this one focuses on the frameworks European mid-market teams face. For the audit side in detail, read our access reviews roadmap for ISO 27001 compliance.

Why Corma for automated access reviews

Corma is built for the company that has outgrown spreadsheets but not the budget or headcount of an enterprise IGA program. It connects discovery, reviews and remediation in one place, so the campaign starts from every app in use and ends with access actually removed.

• Discovery first. Reviews run on access data from all your SaaS apps, and discovery surfaces the ones outside SSO, including shadow AI tools used in the browser.
• One platform. Access reviews, joiner-mover-leaver provisioning, access requests and licence optimization share the same data, through Corma's identity governance and administration platform.
• EU hosting and audited security. Data stays in AWS data centers inside the EU, and Corma undergoes an annual independent ISO 27001 audit.
• Recognized by analysts. Corma was included in the Gartner® Magic Quadrant™ for SaaS Management Platforms in 2025 and 2026.
• Transparent entry point. Corma is the only one of the four vendors to publish a starting price, from €3 per user per month.

Frequently asked questions

What is the best user access review software?

The best user access review software depends on company size and hosting needs. A 50 to 1,000-employee company in the EU should favor a tool that discovers apps outside single sign-on, hosts data in the EU and revokes access automatically, which is the profile Corma is built for. Large programs governing AI agents across on-premise systems usually shortlist C1 or Lumos.

What is the difference between an access review and an access certification?

An access review is the check that each permission still fits the person's role. An access certification is the formal sign-off that the reviewed access is correct, usually run as a scheduled campaign. Vendors often use both terms interchangeably, along with recertification and entitlement review.

Can user access reviews be fully automated?

Most of the process can be automated: data collection, reviewer assignment, reminders, revocation and evidence. The keep or revoke decision should stay with a manager or application owner, because it depends on business context that software can prepare but not judge.

Who is responsible for conducting user access reviews?

Line managers review standard access, application or data owners review sensitive access, and the IT or security team runs the campaign and keeps the evidence. The access control policy should name each of these roles so auditors can see who certified what.

What happens when a reviewer revokes access?

In a tool with closed-loop remediation, the revocation triggers deprovisioning in the target application and the removal is logged as audit evidence. In a manual process, the revocation becomes a ticket, and unprocessed tickets are where orphaned accounts usually survive.

Is ConductorOne the same company as C1?

Yes. ConductorOne renamed itself C1.ai on April 6, 2026, keeping the same team and platform. Older comparison articles still list the vendor as ConductorOne, so search for both names when you check reviews or references.