SSO group drift turned a vendor portal into an access review headache

I ran into an access review problem that started with one vendor portal. The portal used SSO, but the app role was mapped to a broad identity group that had been reused for a different project. Nobody meant to overgrant access. The group just drifted over time, and by the time we reviewed it, a few users could open reports they did not need for their current role. The fix was not just removing…