IT & security · For CISO
Access requests approved quickly, safely and with a full audit trail
- Claude
- Teams
- Okta
- Microsoft Entra ID
The short answer
Claude gathers each access request, compares it with the approved policy for that person's role, and asks the right manager to approve in Microsoft Teams. Once approved, it prepares the change for IT to carry out in Microsoft Entra ID or Okta, and records every step in one audit trail. People still make the decisions; Claude removes the chasing and the paperwork.
Key takeaways
- Access requests move from email chains to one structured, trackable path.
- Claude checks each request against role policy before a manager is asked to decide.
- Managers approve in Teams in a few clicks, with the context they need.
- Every request, check, approval and change is recorded for audit.
Executive summary
Access requests are one of the most common sources of delay and risk inside an organisation. New joiners wait days to reach the tools they need, while over-generous permissions quietly accumulate because nobody reviews them properly. Claude changes the pattern. It collects each request in plain language, checks it against the access policy for that person's role, and routes it to the right manager for approval inside Microsoft Teams. IT receives a prepared change to carry out in Microsoft Entra ID or Okta, and every step is logged. Security leaders gain faster turnaround, fewer exceptions and a clear record that shows who asked for what, who approved it and why.
What is the real cost of slow and loose access management?
Access requests often travel through email, spreadsheets and tickets that nobody owns end to end. A new finance analyst may wait several days for the right shared folder, while a manager struggles to remember whether they approved it. Meanwhile, people change roles and keep the access from their previous job.
The hidden cost is twofold. Delay costs productivity and frustrates staff. Looseness costs security, because excess permissions are exactly what attackers and auditors look for. Both problems grow with headcount and with the number of systems in use.
- Days of waiting for new joiners to access the tools they need
- Permissions that are never removed after a move between teams
- Approvals given by email that are hard to find during an audit
What changes when Claude runs the request process?
Claude becomes the front door for access requests. An employee describes what they need in ordinary words, and Claude turns that into a structured request. It identifies the person's role, the systems involved and the level of access sought, then compares the request with the access policy already approved by the security team.
Requests that match policy are routed for a standard approval. Requests that fall outside policy are flagged with a clear reason, so the manager and the security team can decide quickly. Nothing is granted automatically at the point of decision; a named person always approves.
- Requests captured in plain language, not forms nobody completes
- Automatic checks against the role-based policy already in place
- Exceptions surfaced early with the reason stated
How does Claude connect to Teams, Okta and Microsoft Entra ID?
Claude works through secure connections that each system already offers. Microsoft Teams hosts the conversation where the employee makes the request and where the manager responds with an approval. Microsoft Entra ID holds the user's groups, roles and existing permissions, which Claude reads so it can judge whether a request is consistent with the person's role. Okta, where the organisation uses it for single sign-on and application access, provides the same view of applications and assignments.
Once a request is approved, Claude prepares the exact change IT needs to make. The change is handed to the IT team for completion in the identity system, so the final step remains under the control of the people who manage those systems. The connections respect existing permissions: Claude only sees the directory information the requester and approver are already allowed to see. A closely related automation is Security alerts turned into clear daily briefings for leadership. It is built on Claude for cybersecurity, from Anthropic.
- Teams: request intake and manager approval in the same place people already work
- Microsoft Entra ID: reads roles and group memberships to check consistency
- Okta: reads application assignments where it is used for single sign-on
- IT remains the team that applies the change in the identity systems
What does a day look like for a manager and an IT administrator?
Before the change, a line manager receives an email on Monday asking whether a team member should have access to a reporting tool. They search their inbox for the original request, check the role with HR, and reply days later. The IT administrator then receives a forwarded email and retypes the details into the identity system.
After the change, the manager receives a Teams message that states the request in one sentence, shows that it matches the standard policy for the role, and offers approve or decline. The approval takes under a minute. The IT administrator receives a prepared change with the approval already attached, applies it, and closes the request. The whole cycle takes hours rather than days.
- Manager approvals in Teams instead of searching old emails
- IT receives complete, pre-checked changes rather than retyped details
- Every step is visible to the security team without a separate report
How are governance, security and permissions protected?
The design keeps authority where it belongs. Claude does not hold standing administrator rights. It reads what the requester and approver are permitted to see, prepares a change, and records what it did. Final changes are applied by IT staff using their own privileged accounts, which keeps the separation of duties that auditors expect.
Every interaction is logged: who asked, what Claude checked, which policy applied, who approved or declined, and what IT changed. Those records support internal reviews and external audits. The design supports the expectations of frameworks such as ISO 27001 and SOC 2, though the organisation remains responsible for its own compliance and should confirm requirements with its auditors.
- No standing administrator rights held by Claude
- Separation of duties: approval and change are separate people
- Complete, time-stamped audit trail for every request
- Access reviews supported by recorded approvals and reasons
How should success be measured?
Measure what leaders care about: time to access, the share of requests approved within policy, the number of exceptions, and how many permissions are removed during periodic reviews. Track the audit findings that relate to access, and the time it takes to answer an auditor's question about who had access to a system on a given date.
Teams typically see a meaningful reduction in the time from request to access, often in the range of 40–60% for standard requests, and a clearer, faster evidence trail for audits. These figures are indicative and depend on the starting point and the number of systems involved.
- Average time from request to granted access
- Share of requests that match policy without exception
- Permissions removed during quarterly access reviews
- Time to produce evidence for an audit question
How should an organisation start?
Start with one high-volume request type, such as access to a common business application for new joiners. Agree the policy with the security team, connect Teams and the identity system in a controlled test, and run the process alongside the current method for a few weeks. Expand to other request types once the approvals and audit records are proven.
Claude Automation begins with a free automation audit that maps current access flows, identifies the policies that already exist, and recommends a safe first step. Organisations that already use Microsoft 365 can see how this fits into their wider setup in Claude for Microsoft 365 and enterprise transformation.
- Choose one request type with high volume and clear policy
- Agree the approval rules with security before any connection is made
- Run in parallel for several weeks and compare results
- Expand once approvals and audit records are proven
How it works
The employee asks in plain words
A request for access is made in Teams, described in ordinary language. Claude structures it into a clear request.
Claude checks the role policy
It reads the person's role from Microsoft Entra ID and compares the request with the approved access policy.
The manager approves in Teams
The manager sees a one-line summary, the policy result and the reason. They approve or decline in a single step.
IT receives a prepared change
Approved requests arrive with full context. IT applies the change in the identity system using their own privileged account.
Everything is recorded
Each request, check, approval and change is logged in one audit trail, ready for review or audit.
Before and after
New joiner access to business tools
BeforeEmails and forms over several days, with details retyped by IT
AfterA structured request in Teams, checked against policy and approved within hours
Manager approval
BeforeSearching old emails to find the original request
AfterA one-minute approval in Teams with the context already shown
Removing access after a role change
BeforeOften missed, leaving old permissions in place
AfterFlagged automatically when the role changes, with removal prepared for IT
Audit question about who had access
BeforeDays spent piecing together emails and tickets
AfterA complete, time-stamped record produced quickly
What leaders typically see
- 40–60%Typical reduction in time from request to granted access for standard requests
- Fewer exceptionsRequests matching policy without manual back-and-forth, as typically seen in structured approval flows
- Hours, not daysTypical turnaround for approving and preparing standard access changes
Typical ranges. Your free audit sets a baseline for your own organisation.
What it means for each leader
- CISO
- Policy is applied consistently to every request, and exceptions are visible early with a clear record.
- CIO
- IT receives complete, pre-checked changes, freeing time from re-keying and chasing approvals.
- COO
- New joiners and movers reach the tools they need sooner, reducing lost productivity.
- CHRO
- Role changes trigger access reviews, so former responsibilities do not linger on people's accounts.
- General Counsel
- A complete, time-stamped record of who approved what supports internal reviews and regulator questions.
United States, United Kingdom, India and the Middle East
United States
US organisations may need to align access controls with state privacy laws such as California's CCPA/CPRA and sector rules, for example HIPAA in healthcare or GLBA in financial services. Access records can be kept in US hosting regions, and the design supports the evidence needs of regular audits.
United Kingdom
UK organisations must meet UK GDPR and the Data Protection Act 2018, and may face sector guidance from regulators such as the FCA or NHS bodies. UK hosting is available, and the audit trail supports accountability requirements.
India
Indian organisations should consider the Digital Personal Data Protection Act, 2023, and sector regulators such as RBI, SEBI or IRDAI where relevant. India hosting is available, and access logs can be retained to support internal and regulatory reviews.
Middle East
Organisations in the UAE, Saudi Arabia, Qatar and free zones such as DIFC and ADGM should consider the UAE Personal Data Protection Law, Saudi Arabia's Personal Data Protection Law overseen by SDAIA, and Qatar's data protection law. Data-residency needs are assessed in the free audit and the deployment region is chosen to meet them. Arabic-language requests can be supported.
Safeguards built in
- Claude holds no standing administrator rights and only reads what each user is already permitted to see.
- Named people approve every access grant; Claude never grants access on its own.
- IT applies changes using its own privileged accounts, keeping approval and change separate.
- A complete audit trail records every request, check, approval and change.
- Access policies are agreed with the security team and reviewed on a fixed schedule.
- Customer data stays in the organisation's own cloud account and chosen hosting region.
From audit to rollout
Free automation audit Weeks 1–2
Map current access flows, review existing role policies and identify the highest-volume request type.
Controlled pilot Weeks 3–6
Connect Teams, Microsoft Entra ID and Okta in a test setting, run approvals alongside the current process and refine the policy checks.
Live rollout Weeks 7–10
Move one request type fully into the new process, with IT and managers trained and audit records reviewed by the security team.
Scale-up Weeks 11–16
Extend to other request types, add periodic access reviews and build reporting for leadership and auditors.
The Claude products behind it
Claude for security teams.
Security and compliance information.
Frequently asked questions
What does it cost to leave access requests as they are?
Slow approvals delay new starters and movers, and loose permissions quietly grow over time. Both carry hidden costs in lost productivity and security exposure, and both tend to surface at the worst moment, during an audit or after an incident. A structured process shows where those costs are and reduces them steadily.
Does Claude make access decisions on its own?
No. Claude checks requests against policy and prepares changes, but a named manager approves each grant and IT applies it. Claude holds no standing administrator rights, which keeps separation of duties in place.
Where is our data stored?
Claude runs in the organisation's own cloud account, on Microsoft Azure, AWS or Google Cloud, in a hosting region chosen to meet requirements such as India, the United States, the United Kingdom or the European Union. Data residency needs are confirmed during the audit.
How accurate are the policy checks?
Checks are only as good as the policies they follow, so the security team agrees the rules first. Claude flags anything outside policy for human review rather than deciding it. Accuracy is tested in a pilot before any live rollout.
Will this change how my staff work?
Requesters and managers use Teams, which they already know, and approvals take about a minute. IT staff spend less time re-keying details and more time on complex changes. Training is brief and the process is introduced gradually.
Which Microsoft 365 or identity tools do we need?
Organisations typically use Microsoft Teams and Microsoft Entra ID, and some also use Okta for single sign-on. The audit confirms which of these you already have and what, if anything, needs to be added. You do not need to replace your existing identity systems.
How long does a rollout take?
A focused first phase usually takes around 10 weeks, from the free audit to a live rollout of one request type. Wider expansion follows once approvals and audit records have been proven.
Can this work outside the United States and United Kingdom?
Yes. The approach is used across India and the Middle East, with Arabic-language support where needed and regional data-protection requirements assessed in the audit.