# Delegated Access Reviews Without Giving Away Admin Rights

Use delegated approvals and limited admin roles in Entra, Okta, and SailPoint to keep access reviews moving without broad privilege.

Canonical page: https://mosheldon.com/blog/delegated-access-reviews-without-broad-admin-rights/
Author: OpenTech Consulting
Published: 2026-10-27T12:00:00Z
Updated: 2026-10-27T12:00:00Z

If you want trusted users to approve or review access without handing them broad admin rights, the safest pattern is to delegate only the review work, restrict who they can delegate to, and verify every decision through logs and role scopes.

This is a common IAM operations problem. Leave, travel, and business-owner absences can stall access reviews and approvals, but giving someone full admin access just to keep work moving creates unnecessary risk. Microsoft Entra, Okta, and SailPoint all support some form of delegated review or limited-permission administration, but they do it differently and with different limits.

## What the three platforms actually let you delegate

Microsoft Entra ID Governance supports approval delegation in My Access, where an approver can assign another person to respond to access package approval requests and multi-resource access reviews on their behalf. Microsoft says this delegation is limited to one level, can be time-bound or indefinite, and only applies to approvals explicitly assigned to a person, not to items assigned through a group. It also applies only to multi-resource access reviews, not single-resource reviews such as a single group or application. Using this feature requires Microsoft Entra ID Governance or Microsoft Entra Suite licenses, and some related capabilities may work with Microsoft Entra ID P2 for specific use cases; check current licensing guidance before you plan rollout. Source: [Microsoft Entra delegation in My Access](https://learn.microsoft.com/en-us/entra/id-governance/delegate-approvals-my-access).

Microsoft’s access review planning guidance also says access reviews can be delegated to admins, business owners, or users who self-attest to continued access. The same page lists the roles involved in creating and reading different review types, which is important because the person who creates a review decides who will do the review, and that setting cannot be changed after the review starts. License requirements again depend on the feature set and may require Microsoft Entra ID Governance or Microsoft Entra Suite subscriptions. Source: [Plan a Microsoft Entra access reviews deployment](https://learn.microsoft.com/en-us/entra/id-governance/deploy-access-reviews).

Okta uses a governance delegation model for access certifications and access requests. Okta’s governance docs say delegates can be appointed for tasks such as access certification reviews and access request approvals, and that end users can appoint delegates themselves if the org allows it. Okta also supports restricting who can be a delegate, such as limiting delegates to a manager or peers, and it distinguishes between user-based and service-based API access. For admin-controlled delegation, some operations require SUPER_ADMIN or other specific governance admin roles, while regular users can manage their own delegate settings if granted the right scopes and the org setting allows it. Source: [Okta governance delegates](https://developer.okta.com/docs/guides/iga-delegates/main/).

Okta’s permissions model also matters if you are trying to keep admin access narrow. Okta says custom roles can define a specific set of permissions and resources, and principals assigned to that role are limited to those permissions and resources. Some permissions are tied to governance or standard IAM roles, and some are only available in specific role models. That makes Okta a better fit when you need to separate, for example, group membership management from app management or user lifecycle control. Source: [Okta permissions catalog](https://developer.okta.com/docs/api/openapi/okta-management/guides/permissions).

SailPoint takes a slightly different route. Its certification model can present entitlements, access profiles, and roles for review, but what can actually be certified or revoked depends on how access was granted. SailPoint also prevents self-certification by automatically routing work away from the person whose access is being reviewed. If a certifier signs off and the source is directly connected, SailPoint can remove revoked access automatically; if not, it creates a task for manual remediation. Phased availability applies to some SailPoint capabilities, so check the edition and current rollout status before relying on a specific workflow. Source: [SailPoint certifications overview](https://documentation.sailpoint.com/saas/help/certs/understanding_certifications.html).

## A practical operating model that avoids broad admin rights

The safest pattern is not “let someone do everything.” It is “let them do one specific governance job, in one specific scope, for one specific time window.”

Start by separating these jobs:

- Approval of access requests
- Recertification of existing access
- Delegated coverage for someone who is absent
- Ongoing administration of the identity platform itself

Then assign the narrowest role or delegate setting that matches the job. In Entra, that may mean a business owner reviews access packages while IT keeps entitlement management settings and admin roles separate. In Okta, you can use custom roles and governance permissions to limit someone to access reviews or access requests without giving them full org control. In SailPoint, you can keep certifiers focused on certification decisions while remediation follows the platform’s approval and provisioning rules.

A useful rollout sequence is:

1. Pick one low-risk resource first, such as a department group or a nonproduction app.
2. Decide whether the reviewer will be the resource owner, a manager, or a named delegate.
3. Set a maximum delegation period for absences and require a clear end date where the platform supports it.
4. Limit who can be selected as a delegate, such as direct manager only or an approved group.
5. Confirm what happens if no one responds on time: automatic removal, manual follow-up, or no action.
6. Test notifications and audit logs before expanding the process.

## Tradeoffs to plan for

Delegation solves a business continuity problem, but it creates governance tradeoffs.

One tradeoff is visibility. In Microsoft Entra, the original approver can still respond during the delegation period, and delegates can see who delegated the item, but they cannot redelegate. That reduces confusion, yet it also means you need a clear rule for which person has the final say. In Okta, delegated governance tasks are not transitive, so if User A delegates to User B and User B delegates to User C, User C does not inherit A’s work. That is safer, but it means you need backup coverage plans instead of assuming chains of delegation will work automatically.

Another tradeoff is scope. Microsoft Entra delegation for access reviews only covers multi-resource reviews, so if you rely heavily on single-group or single-app reviews, you need another operational plan. SailPoint’s ability to automatically remove revoked access depends on the source connection and provisioning path; when direct provisioning is unavailable, remediation becomes a task for a human to complete outside the tenant.

Licensing and edition boundaries also matter. Microsoft states that delegation features require specific governance licenses, and some related capabilities may be available with P2 in certain cases. Okta’s governance permissions and delegate settings depend on your org’s governance subscription and role model. SailPoint notes phased availability for some certification capabilities. Treat all of these as things to verify in your own tenant and contract, not assumptions to make during rollout.

## How to verify the workflow is really least privilege

Do not stop at “it works.” Verify that it works with the right limits.

Check these controls:

- The reviewer can complete the task, but cannot manage unrelated admin settings.
- Delegation has an end date or an approved policy for indefinite delegation.
- The delegate cannot redelegate unless your policy explicitly allows it.
- The workflow only touches the resource types you intended.
- Review outcomes are logged and auditable.
- Automatic remediation happens only where provisioning is approved and tested.

For Microsoft Entra, confirm which review types are eligible and which roles can create and read them. For Okta, confirm the scopes and admin roles needed for each API or console action. For SailPoint, confirm whether the source supports automated remediation or requires manual follow-up. In all three products, test what happens when a reviewer is unavailable, a delegation expires, or a reviewer does not act before the deadline.

A practical rule is simple: if the system can’t prove who approved what, when, and under which scope, the process is not ready for production.

For teams already using identity workflows, this is a good place to connect your review process to broader operations such as [access cleanup before renewals](https://mosheldon.com/blog/cut-saas-spend-by-reviewing-access-first/), [identity-first security planning](https://mosheldon.com/blog/identity-first-security-2025-retrospective/), and [privilege creep review steps](https://mosheldon.com/2025/07/10/managing-user-privilege-creep-why-its-critical-for-security-and-efficiency/). Those articles can help you turn review results into follow-up actions instead of leaving decisions in a queue.

The short version: let people approve and review access, but keep platform administration separate. Use scoped delegation, short approval chains, and audit checks so the business keeps moving without turning every absence into a privilege expansion.

## Sources and references

- [Delegate approvals and access reviews in My Access (Preview) - Microsoft Entra ID Governance](https://learn.microsoft.com/en-us/entra/id-governance/delegate-approvals-my-access): Supports a practical section on delegating approval and access-review work in My Access, including one-level delegation, start/end dates, and removal steps.
- [Plan a Microsoft Entra access reviews deployment - Microsoft Entra ID Governance](https://learn.microsoft.com/en-us/entra/id-governance/deploy-access-reviews): Supports how access reviews can be delegated to admins, business owners, or self-reviewers, and which roles can run reviews.
- [Manage delegates for governance - Okta Developer](https://developer.okta.com/docs/guides/iga-delegates/main/): Supports the governance-side pattern of assigning delegates for reviews, showing the API and workflow concepts for delegated governance administration.
- [Permissions - Okta Developer](https://developer.okta.com/docs/api/openapi/okta-management/guides/permissions): Supports a least-privilege angle for Okta custom roles, including that principals are limited to defined permissions/resources and that some delegated admin abilities are constrained.
- [Understanding Certifications - SailPoint Identity Services](https://documentation.sailpoint.com/saas/help/certs/understanding_certifications.html): Supports a review-and-certification model where entitlements or access-request outcomes can be certified or revoked, useful for comparing delegated review workflows across tools.