Access Fabric

Entra access reviews,
with an operator UI.

Guest reviews, app-access reviews, and JML hooks on Microsoft Graph.

ISO 27001 · DORA · GDPR

Capabilities

Guest reviews, app access, and JML on Graph

  • Guest access reviews

    Reads your guest-user inventory from Entra ID and drives the review through Entitlement Management instead of leaving it half-configured in the portal.

  • Application-access reviews

    Reviewers see the app, the role, and the last sign-in date, then decide keep or remove without opening five blades in the Entra admin center.

  • Dormant access and orphaned roles

    Flags accounts with no recent sign-in, surfaces role assignments whose owner has left, and sends reviewer reminders in Teams when attestations go quiet.

  • JML hooks

    Joiner, mover, and leaver events from your HR feed and Lifecycle Workflows route access requests and revocations to your ITSM — roles get pulled, not just the account disabled.

  • Guest inventory

    Every guest in one list with last sign-in, the source application that invited them, and the sponsor on record — filter the stale ones and send them into a review campaign.

  • Per-campaign audit exports

    Each campaign exports the decisions, reviewer, and timestamp — ready for an ISO 27001:2022 access-control review or a NIS2 Article 21 check without rebuilding it from screenshots.

In the product

The operator console

Access Fabric dashboard
Access Fabric reviews screen
Access Fabric provisioning screen
Access Fabric sign-in screen

Dashboard — reviews, decisions, and JIT grants at a glance

How it works.

  1. Connect your tenant

    Access Fabric authenticates to Entra ID through Microsoft Graph with the consented permissions it needs to read users, groups, guests, and role assignments. Nothing in your directory changes on connect.

  2. Run the campaign

    Pick guest, application, or dormant-access. Access Fabric builds the review in Entitlement Management, routes attestations to managers over Teams, and sends reminders to reviewers who have not answered.

  3. Act and export

    Approved access stays. Removals and orphaned roles are cleaned up, leaver revocations fire through your ITSM, and the campaign decisions export as audit records for review.

Pricing.

Flat monthly pricing per tenant. Every plan starts with a 90-day trial — no credit card required.

Single tenant

€149 / month

Per month · 90-day trial, no card

  • One Entra tenant
  • Up to 500 governed identities
  • Guest review module
Get started

MSP

from €799 / month

Per month · 90-day trial, no card

  • Multi-tenant admin
  • Per-customer reporting
  • Reseller-ready
Contact sales

Questions.

  • Where is tenant data processed and stored?

    Access Fabric reads your Entra directory through Microsoft Graph and writes review decisions back through the same API. Processing and storage stay in the EU region you select at onboarding. We do not stand up a parallel identity store — your users, groups, and access packages remain in Microsoft Entra.

  • How does sign-in work?

    Operators sign in through Spot Suite OIDC with passkeys, authenticator-app MFA, or your existing IdP federation. Access Fabric connects to Entra ID with a separate admin-consented Graph application; end users never authenticate to Access Fabric directly.

  • What compliance frameworks does it map to?

    Review campaigns and audit exports are structured for ISO 27001:2022 controls A.5.15 (access control), A.5.16 (identity management), and A.5.18 (access rights), plus NIS2 Article 21 access-governance and audit-record requirements. Each decision records the reviewer identity and timestamp.

  • What does the 90-day trial include?

    One Entra tenant, up to 500 governed identities, and the guest review module — full audit exports included. No credit card is required to start. When the trial ends, upgrade to Single tenant at €149/month, Campaigns from €299/month, or contact us for MSP from €799/month.

Start your first access review

Connect Entra ID, run a guest review, and export the audit record. Every plan starts with a 90-day trial — no card.