Summary: The identity provider is the highest-stakes surface in any enterprise identity environment — a compromised Okta Super Admin or Entra ID Global Administrator can rewrite policy, modify MFA, and grant access to anything. Oleria Trustfusion, an AI-native identity security platform, brings identity provider admin review into the standard governance program with Group Membership campaigns scoped to IdP groups — using the same three-signal evidence engine that powers every other Oleria review.
IdP access is the highest-stakes identity surface. A Global Admin in Entra can create accounts, change MFA, modify federation, grant themselves access to anything. An Okta Super Admin can rewrite policy. Native IdP review tooling exists but typically runs as a one-time export at quarter-end. By then, three months of admin grants, removes, and re-grants have happened.
Most environments treat IdP governance as a separate process from regular access reviews — a special spreadsheet, a special meeting, a special escalation path. The result: the highest-leverage population in identity gets the least standardized review treatment.
The same three-signal engine that powers every Oleria review applies to IdP reviews. Recommendations are conservative; the architect makes the call.
IdP group reviews on a regular cadence Achieved
Inactive IdP group users surfaced Continuously via dormancy signal
IdP user sprawl Bounded
Audit findings on IdP groups governance Eliminated
Entra ID Global Admins and Okta Super Admins are the most-leveraged identities in your environment — yet most organizations review them on spreadsheets, quarterly at best. Oleria makes IdP admin review a continuous, evidence-driven control. See how.
AD group reviews live on D-17 (Active Directory Group Membership campaigns). AD does not expose dormancy at the access-review layer, so AD group reviews use peer match + HR change plus AD-specific group context (description, owner) pulled at campaign setup. Oleria's access graph unifies AD and cloud IdP visibility; the review feature splits by directory type.
Each user appears as a line with three-signal evidence — dormant days (days since last login), peer match, HR change for the specific group in review. Reviewer assesses; bulk-accept the matches, examines outliers with an override per line. Removal flows back to the IdP and downstream apps.
Configurable per IdP based on group type, utilization and total users.
