How to Review User Access in PIMS Using XLSX Report Integration

Organizations need clear and efficient ways to demonstrate who has access to what systems and when. This is especially important when responding to compliance requirements, internal audits, or external reviews. Identity Panel’s Policy Information Management System (PIMS) supports user access reviews by enabling report-based integration through Excel (.xlsx) files. This article explains how this process works and how it benefits your organization.

Automate Access Review with XLSX Integration

Identity Panel’s Access Panel includes support for reviewing user entitlements (access rights) using attestation campaigns. These campaigns generate a comprehensive view of users and their access across systems. To facilitate easy review and sign-off by non-technical stakeholders, this information can be exported to Microsoft Excel.

Using XLSX format provides the following advantages:

• Standardized Output: Reports are structured in a predictable format, making it easy to read or load into other systems.

• Offline Review: Stakeholders can review and annotate access data without needing access to Identity Panel.

• Audit-Friendly Format: XLSX files can be securely stored and referenced for audit purposes.

End-to-End Workflow

The process to run a user access review using PIMS and XLSX integration typically includes:

1. Campaign Setup: Define the scope of the access review (e.g., all users with administrative privileges, or those with access to financial data).

2. Export Access Data: Identity Panel generates an XLSX file that lists users, their entitlements, and relevant metadata (e.g., last access date, department, manager).

3. Distribute for Review: XLSX reports can be sent to reviewers (such as department heads) for manual validation and sign-off.

4. Import Decisions (Optional): Responses or updated files can be uploaded back into the system to record decisions and close the campaign.

These campaigns are managed within the Access Panel and governed by configurable policies that determine who can approve access, what actions to take on revocation, and how to escalate exceptions.