GlobalSecurity/Compliance

User Access Review & Recertification

Name: User Access Review & Recertification
Price: 71 USD

Periodic access recertification campaigns, approve/revoke rights, audit trail

Odoo 20.0Odoo 19.0Odoo 18.0

Compatible with Odoo 18.0 · 19.0 · 20.0

OPL-1 license · 35+ languages · Community & Enterprise

User Access Review & Recertification

Periodic access recertification campaigns, approve/revoke rights, audit trail

User Access Review & Recertification brings periodic who-has-access-to-what recertification into Odoo without any external Identity/IAM platform. A manager launches a review campaign, every reviewer approves or revokes each access right one by one, and revocations are actually enforced on the user's account, with a full evidence trail of every decision.

Key Features

New Campaign wizard auto-resolves scope

access.review.campaign.wizard reads the CURRENT security groups of every selected user and generates one access.review.item per user x access-right pair automatically, with a configurable exclude list for noise groups like the base Internal User flag.

Campaign dashboard and lifecycle

Each access.review.campaign tracks item count, completion rate, pending/approved/revoked counts and an overdue flag, moving through a Draft, In Progress, Completed, Cancelled workflow enforced by action_start/action_complete/action_cancel/action_reopen.

Approve or revoke with mandatory justification

Each access.review.item is a single user x access-right row decided via action_approve or action_revoke; validate_decision_input requires a justification whenever the decision is Revoke.

Revocation is actually enforced

action_apply removes the res.groups access right from the user's group_ids for real via an unlink command, so a revoke decision genuinely cuts off access, not just a paper record, with a bulk action_apply_revocations from the campaign.

Full audit trail via chatter and activities

Both campaign and item inherit mail.thread/mail.activity.mixin: every decision is tracked, review reminders are scheduled as to-do activities on the reviewer, and applying a revocation posts a chatter note on both the item and the campaign.

Overdue detection and daily reminders

A computed is_overdue field (with a matching search method) flags pending items and campaigns past their deadline, and the _cron_send_deadline_reminders scheduled action posts a chatter summary and nudges the campaign owner once per overdue campaign.

Completion gate on unresolved rights

action_complete blocks closing a campaign until every item has an actual Approve/Revoke decision and every decided revocation has been applied, so no recertification round can finish with unresolved access.

My Reviews personal list

Every reviewer can filter to exactly the access-right items assigned to them as reviewer_id, independent of who else is reviewing the same campaign.

Use Cases

✓Run a quarterly SOX or ISO 27001 access recertification without buying a dedicated IAM/GRC platform

✓Prove to an auditor that every user's access right was actually reviewed and, where needed, actually revoked

✓Automatically generate review items from each user's real current groups instead of building a spreadsheet by hand

✓Chase overdue reviewers automatically with scheduled to-do activities and daily chatter reminders

✓Let each manager work only their own assigned 'My Reviews' queue inside a larger recertification campaign

Screenshots

01 Campaign List

02 Campaign Form

03 Review Item List

04 Review Item Form

05 New Campaign Wizard

Why Choose This Module

Unlike a spreadsheet-based access review, every decision here is enforced and auditable inside Odoo itself: revoking a right is a single click that genuinely removes the security group, every approve/revoke carries a timestamp, decider and justification, and a campaign simply cannot be marked complete while any access right is still unresolved.