C4SAM Identity Governance answers the questions that take days in most organizations: every identity, every account, every technical credential, in one picture. Read-only first, in your environment, without identity data leaving the building.
We hear these ten questions in almost every conversation with people responsible for IT and security. Hardly anyone can answer them in ten minutes.
Who has access to what, across all systems?
How many accounts belong to one person?
Which service accounts, API tokens, apps and client secrets exist?
Who owns them, and is that person still here?
What happens to a person's technical identities when they leave?
Who is an administrator, by which path?
Who sees across organizational boundaries?
Who can shut down the production VM?
Can we show that to an auditor in ten minutes?
What if a token lands in the wrong repository, or the colleague who owns half of the service accounts resigns?
For most of these questions, we already have a page, a report or a campaign. Every answer carries the name of the person who confirmed it.
Connectors read Active Directory per forest, Entra ID with guests, groups, Teams, enterprise apps and SharePoint sites, the HR system, GitLab, LDAP and Proxmox. On a schedule, with a run log. Accounts are matched to people via employee number and rules. Anything ambiguous lands on a clarification list. File servers, Exchange, SQL and SAP follow in your order of priority.
Every resource gets an owner, proposed from the source systems and confirmed by a human. Campaigns review guests, admin accounts, privileged groups, apps, Teams and SharePoint sites, once or recurring. Every decision is recorded with time, person and reason.
Joiner, mover and leaver events come from the HR system: rule, plan, approval, execution, feedback to HR. In Active Directory, plans and revocations are executed directly. Every further target system is enabled only after a dry-run period with plan preview. Until then, a revocation remains a documented order.
Service accounts, API tokens, app registrations, client secrets, certificates, automations. They have no employee number, no manager and no leaving date. They keep running long after their creator is gone.
C4SAM treats them like personal accounts: inventory, owner, expiry date, last use, recertification. Privileged accounts need two owners. The owner is tied to the person in the HR system, not to a name in a spreadsheet. When that person leaves, the resource is flagged as orphaned and goes into the next review.
Groups with subsidiaries, public administrations, hospital networks, universities: many organizations, one Active Directory, one tenant.
C4SAM separates them strictly in the database. Each organization sees only its own identities, roles apply per organization, and shared directories are assigned through rules. Looking across the boundary is possible in an emergency: time-limited, justified and logged.
Captain Sam is the assistant inside the Cockpit. It answers questions about access, helps with operation and supports drafting rules. It runs on a language model in your environment, has read-only tools and sees only what the signed-in person sees. Creating and approving stays with humans.
"Which privileged groups have no owner?"
Currently 14 privileged groups across Active Directory and Entra ID have no confirmed owner (including Domain Admins, Account Operators and Server Operators). 9 groups have owner suggestions derived from the source systems.
→ Open in Accountability View (Filter: Privileged & Without Owner)Every decision, every change and every connector run goes into the audit log, exported to your SIEM. Campaign reports and revocation lists are available at the push of a button. Evidence for NIS2 Article 21, ISO 27001 A.5.15 to A.5.18, internal audit and external auditors is produced in daily operation, not in a project beforehand.
Identity Governance is a module of the C4SAM Cockpit, the platform for security, automation and monitoring: self-hosted, one interface, one data model. If you already run the Cockpit, you enable the module. If you are new, you start with Identity Governance and grow from there.
Installation in your environment, directories and HR connected read-only, first findings report.
Owners named, campaigns running, evidence in the SIEM.
File servers, Exchange, SharePoint depth, SQL, all read-only.
Provisioning and revocation, per target system after a dry-run period.
SAP, helpdesk, telephony, licenses, in your order of priority.
Every phase ends with measurable results and a formal acceptance. Operations are optional and start after the pilot.
Who is accountable for which access? Most organizations cannot answer that question. In our exclusive whitepaper, we show how C4SAM links every account, human or technical, to an accountable person, turning scattered accounts into traceable, reviewed access rights.
Download Whitepaper (PDF)We show you on our demo environment what the answers to the ten questions look like, and discuss what a pilot would reveal in your environment. With your questions.