Acquirers should verify who holds admin rights, whether multi factor authentication covers every human account, how leavers are removed, and where service accounts and shared secrets live. Access is the fastest path from a small compromise to a large one, so it deserves its own diligence track.
Collect the lists
Request exports, not descriptions:
- Admins in the identity provider, cloud accounts, source control and CI.
- Everyone with production database access.
- Service accounts and API tokens, with owners and last use.
- Contractors and third party accounts.
Check coverage
- Is multi factor authentication enforced, or only offered?
- Are there exceptions, and who approved them?
- Do break glass accounts exist, and are they monitored?
- Is single sign on used for most apps, with a list of those outside it?
Test offboarding
Pick five people who left in the past year and ask for evidence their accounts were disabled, with dates. Check source control, cloud and any tool that sits outside single sign on. Slow offboarding reveals more than a policy document.
Service accounts and secrets
Long lived tokens with broad permissions are a common weakness. Ask where secrets are stored, how they rotate and whether any appear in repositories or CI logs. Check that tokens used by automation have narrow scopes.
Agents and automation
If the target runs AI agents or automation with credentials, list what each can reach. Agents deserve identities with scoped permissions and an audit trail like any other service account.
Review cadence
Ask for the last two access review records. A quarterly review with real removals shows the process works. A review that never removes anyone deserves a second look.
Plan the merge
Do not connect identity systems on day one. Map roles first, remove stale accounts, then federate. The first 100 days guide covers sequencing.
Safeguard offers agent identity and asset discovery features that help with the inventory step.
Red flags worth a second look
A few patterns deserve follow up questions. Shared admin accounts used by several people. Production database credentials stored in team chat. Service accounts with owner level cloud rights. Contractors with active accounts long after their contract ended. Multi factor authentication exempted for convenience.
None ends a deal on its own. Each is a cheap fix when found early, and each increases the chance that one phished credential becomes a major incident.
Write them down with the evidence you saw. During integration, work them first, before any merging of identity systems, because connecting two environments gives every weak account a wider reach.
Quick check
What is the single most useful access check?
Compare the leaver list with active accounts. It tests process in practice.
Last reviewed: 19 October 2026.
