What may someone have?
Application profiles based on role, department and approved exceptions.
APPLICATION AND LICENCE MANAGEMENT
From application register to application control.
A register shows what has been recorded. Application control also shows what policy allows, what actually exists technically and where an exception requires attention.
ONE EMPLOYEE. THREE REALITIES.
Is the record correct, and is the access justified?
What do we think someone has?
The relationships between people, applications and licences in TOPdesk or another system of record.
What access actually exists?
Accounts, groups and rights in Active Directory, Entra, an identity provider and applications.
EXCEPTIONS THAT BECOME VISIBLE
Not every difference is wrong. Every difference must be explainable.
Technical access exists, but administration is incomplete.
The record shows access that is no longer present in the system.
Potentially unwanted, historic or out-of-process access.
PRACTICAL EXAMPLE
From technical group to recognisable application.
SAS reads relevant group memberships, translates them to applications, matches users to the correct person and compares the result with records and profile.
AD / Entra→Group membership→Translation table→Person & application→TOPdesk→Profile check
LICENCES
Expose cost exceptions.
Technical access may be linked to a paid licence. Comparing access and profiles shows where investigation or action is needed. Access does not automatically prove usage; additional sources can be connected for that.
GOVERNANCE
Give every exception an owner.
Record who defines policy, approves exceptions, handles deviations, makes decisions and when verification occurs again.
START WITH ONE APPLICATION
Plan an application control scan