Automated Okta User Access Reviews
Every month, WebRun signs into the Okta admin console, reads every active user with their group memberships and assigned applications, flags dormant accounts and anyone holding admin-level apps, writes the whole review into Airtable, and drafts a Gmail sign-off request per manager that waits for your approval.
How do I run a monthly user access review without doing it by hand?
WebRun signs into Okta each month and reads every active user with their groups, assigned applications, and last sign-in, flagging dormant accounts and admin-level holders. It records the dated review in Airtable and drafts a Gmail sign-off request per manager, held in Drafts until a human sends it.
- A dated access review exists every month without manual assembly
- Dormant accounts and admin holders are flagged before an auditor finds them
- Managers get a short list of only their own reports
Built for IT admins · security teams · compliance managers · growing SaaS companies
What does WebRun do on every run?
The exact actions WebRun takes, in order - in plain language, so you can adjust anything.
-
WebRun signs in and gets to work
Opens
login.okta.comin a real browser with your saved login - no setup, no API keys. -
1
Okta - read users and app assignments
okta.com
WebRun opens Okta to read users and app assignments. - Sign in to the Okta admin console and open the people directory
- Capture every active user with their status, groups, and assigned applications
- Note the last sign-in date and flag anyone dormant beyond your threshold
- Flag every user holding an admin-level or finance application
- Read only. Never deactivate a user or change an assignment
Done when Every active user is listed with their apps, groups, and last sign-in.
-
2
Airtable - record the review evidence
airtable.com
WebRun opens Airtable to record the review evidence. - Open your access review base and create this month's dated review
- Write one record per user with department, manager, apps, groups, and last sign-in
- Mark dormant accounts and admin-level holders as items needing a decision
- Link each record to last month's review so removals are traceable
Done when This month's access review is recorded with every exception marked.
-
3
Gmail - draft the manager sign-offs
gmail.com
WebRun opens Gmail to draft the manager sign-offs. - Draft one email per manager listing only their own reports and each person's apps
- Ask the manager to confirm, or name the access to remove
- Leave every email in Drafts for a human to read and send. Nothing goes out on its own
- Link the Airtable review so the manager can answer in one place
Done when A sign-off email is drafted and waiting for every manager with reports.
How is each run configured?
Secure by default
Connect once, stays signed in
WebRun signs in once and keeps each session in a persistent environment, so every run picks up right where it left off.
Every action is checked against this policy before it runs.
Questions, answered
Will it deactivate users or remove access?
No. WebRun reads Okta only. It never deactivates an account, removes an app assignment, or edits a group. Every change is left for an administrator to make by hand.
Does it email managers on its own?
No. Each sign-off request sits in Gmail Drafts until a human reads and sends it, so nothing reaches a manager without your approval.
Is the review good enough for an audit?
Every run writes a dated Airtable record naming each user, their apps, groups, and last sign-in, linked to the previous month, which gives an auditor a traceable history.
Related templates
Put this on autopilot.
Turn it on in minutes - or have our team set it up for you.