Why a concept is needed
Without a concept, rights are granted "on request": an employee changes department and keeps old access, new colleagues get copies of others' permissions. After years nobody has an overview and audits become detective work.
Approach in steps
- Inventory: which systems, folders and applications exist and who has access today?
- Define roles: task profiles such as accounting, sales, administration, IT administration.
- Assign permissions to roles, not to individuals.
- Groups carry the rights: users go into role groups, resources are assigned to groups.
- Name owners: who approves access to which data?
- Make the joiner, mover, leaver process binding.
- Review regularly: recertify rights, for example annually.
Proven patterns
In Windows environments nesting has proven itself: users in global groups, these in domain-local groups to which resource rights are assigned (AGDLP). In cloud environments Entra groups and role-based access control take over. The principle of least privilege is what matters.
Result
An understandable document describing roles, rights, owners and processes, and a technical implementation that matches it. This eases audits, onboarding and evidence under data protection and security requirements.