Platform guide: Access review pack

Where the fields this tool uses live in ServiceNow's GRC attestation capability, and in Flexera One. Where no source names a module, table, or field, that is stated as a gap rather than guessed.

ServiceNow: access certification through Policy and Compliance Management attestations

ServiceNow's own access-certification capability sits inside Policy and Compliance Management, part of its Integrated Risk Management (IRM) product line, and is driven by control attestations rather than a standalone "access review" object. ServiceNow's own documentation confirms the structure directly: the Control Objectives module is the main hub of the Policy and Compliance Management application; a Control is a specific implementation of a control objective; an Entity is a person, process, department, application, or object whose risk exposure must be managed and monitored; and Attestation assesses the control to continuously monitor its compliance. No backing table name is given for any of these records. The setup pattern a ServiceNow Community thread describes for running a user access review: create a Control Objective and link it to the Entity Type being reviewed (for example, users holding access to a given system); that generates one Control per entity, and each control routes an Attestation to its named Control Owner, who confirms the access is still needed and attaches their decision as evidence.

Evidence collection runs one of two ways. A Manual Indicator is used to gather the control owner's response as evidence by hand. Where ServiceNow has been connected to an identity and access management (IAM) solution, an Automated Indicator can instead continuously monitor the control, which is the mechanism this method's account-to-person matching maps onto: the account and person data behind an automated indicator's continuous check is expected to come from that connected IAM system, not from a table inside ServiceNow itself. No ServiceNow documentation names a specific field or table that stores the account-to-person match this method's step 3 performs; the Attestation and Control Owner objects above are what carries the decision, not the underlying account export.

ServiceNow does not natively ship a standalone identity-governance or access-certification module beyond Policy and Compliance Management's attestations; full identity-governance workflows (for example, certification campaigns run against an identity warehouse) are delivered by third-party apps such as Saviynt's ServiceNow Store integration, not by ServiceNow itself.

The Control Objective / Entity Type / Control / Control Owner / Attestation / Manual Indicator / Automated Indicator terminology above comes from a ServiceNow Community discussion, cross-checked against ServiceNow's own structural-overview and entity-definition documentation, and matches the vocabulary used across ServiceNow's GRC release notes.

Flexera One: application usage data for dormant access

Flexera One's SaaS Management surfaces the usage evidence this method's dormant-access check (no login in 90 days) would draw on. Flexera states it can identify underused licenses and find downgrade opportunities from bundled subscriptions, built on detailed usage insights drawn from multiple discovery methods — financial data, API connectors including a Universal Connector, a browser extension, and connections to SSO and CASB technologies — covering both sanctioned and unsanctioned (shadow) applications. The product combines application usage, spend, and contract information to recommend right-sizing licenses and eliminating unused applications.

Flexera One's SaaS Management Users Tab has a named column, Days Since Last Activity, which reports "Never Active" for accounts with no recorded login — the threshold is 60 days without login, or 30 days when an application is first integrated — the closest named equivalent to this method's last_login column. Flexera's documentation site (docs.flexera.com/...) does not return readable content to a direct automated fetch, so the column name above is sourced from a search-engine-indexed excerpt of the Flexera-authored page rather than a direct fetch; everything else in this section comes from Flexera's own marketing page, which did load.

Sources checked

• Access Reviews in P&C — ServiceNow Community — Control Objective, Entity Type, Control, Control Owner, Attestation, Manual Indicator, Automated Indicator, and the connected-IAM-solution route to continuous monitoring.
• Policy and Compliance Management structural overview — ServiceNow Docs, Xanadu — Control Objectives module, Control, and Attestation definitions.
• What is an Entity? — ServiceNow Docs (GRC common functions), Washington DC — Entity and Entity Type definitions.
• Identity governance on ServiceNow — Saviynt blog (search-confirmed; not independently fetched) — the third-party, partner-built route to full access-certification workflows.
• Optimize SaaS spend and utilization with Flexera One SaaS Management — Flexera — underused-license identification, multi-source discovery (financial data, API connectors, browser extension, SSO/CASB), usage-and-spend-based optimization recommendations.
• SaaS Management Users Tab reference — Flexera Docs (search-indexed excerpt only; direct fetch returns 403) — the "Days Since Last Activity" column.
• Tracking user activity — Flexera Docs (search-indexed excerpt only; direct fetch returns 403) — the 60-day ("Never Active") / 30-day (first integration) thresholds.

ServiceNow's own IRM product page (servicenow.com/products/integrated-risk-management.html) does not return readable content to an automated fetch. Flexera's documentation site (docs.flexera.com/...) does not return readable content to a direct automated fetch on any page tried, including the Users Tab and activity-tracking references cited above by search-indexed excerpt. Everything else above comes from a page that loaded.