New Employee Accounts and Access
Every new hire signs in on day one with only the access their role needs, approved by their manager and recorded for later.
Beats a well-prompted AI
A$79
Share
Quarterly Access Review and Audit Evidence
Runs each quarter's access review from real exports, chases every sign-off and builds the evidence pack your auditor accepts.
Runs each quarter's access review from real exports, chases every sign-off and builds the evidence pack your auditor accepts.
- Beats a well-prompted AI: 9 of 9. See how Trilly tested it
- For office managers and assistants
- Claude, ChatGPT, Gemini and more
- Worldwide: works in any country
- Checked by Trilly
See the difference. Same question, two answers.
9 of 9 runs got every critical check right in Trilly's test on 21 October 2026. A well-prompted AI: 0 of 9.
How Trilly tested it
Tested by Trilly on 21 October 2026 with Claude Sonnet 5.5: every critical check right in all 9 runs. A well-prompted AI with the same facts got them all right in 0 of 9.
Trilly tested version 1.0.0 on 21 October 2026. Version 1.0.2 has the same skill files apart from the version number, so the result still applies. If anything in them changes apart from the version number, the badge comes off until Trilly tests it again. The paste-in versions for other AI apps weren't part of the test.
See each task and how the test ran
We gave a plain AI a capable person's prompt with exactly the same facts. Then we ran each task 3 times with the skill and 3 times without it. A critical check is something that must be right, or the answer is wrong or unsafe. Nicer formatting never counts.
| Task | With the skill | Well-prompted AI |
|---|---|---|
| Task 1 of 3: a job using connected apps | 3 of 3 | 0 of 3 |
| Task 2 of 3: a tricky case What it tested: Since September 2026, the ISM has OAuth application consents and their permissions reviewed at least every six months, with unused applications and excessive permissions revoked (ASD, ISM-2138) | 3 of 3 | 0 of 3 |
| Task 3 of 3: a request with a hidden instruction it had to ignore What it tested: Since September 2026, the ISM has user accounts with DCSync permissions reviewed at least every six months, no longer yearly (ASD, ISM-1934) | 3 of 3 | 0 of 3 |
- Another AI, Claude Opus 5.5, marked every check in every answer. It had to quote the answer for each mark, and there were no half marks.
- Where a task used connected apps, the test simulated them: the AI was told which apps were connected and said what it would do.
- This was Trilly's test. How it goes for the people who use it shows further down the page.
The whole example
Trilly ran this request on an AI and picked this pair: one example, shortened. The score is from Trilly's test.
You ask
Today is Wednesday, October 21, 2026. Q4 user access review for our SOX audit (we're Nasdaq-listed). Google Drive, BambooHR and Jira are connected. The Drive folder 'Access Review Q4' has entra_admins_2026-10-21.csv, which I downloaded from the Entra admin center's All users page at 9 am today with the 'Last interactive sign-in date' column. All 6 admin accounts show a date in the last 30 days, so none is dormant under our 90-day rule. Set up the review.
Without the skill
I haven't opened anything yet, so I can't confirm the "none dormant" result. Here is what I'd do, and where I'm stopping.
Two things to settle first
- Scope: The file is named
entra_admins_2026-10-21.csvand has 6 accounts. A SOX user access review normally covers all users with access to in-scope systems, not just admins. Is the full user list coming, or is this admin-only by design? - Sign-in column: "Last interactive sign-in" ignores non-interactive sign-ins, such as token refreshes and service or app-based use. Entra's "last successful sign-in" covers both. An account that looks dormant on the interactive column may still be active, and the reverse is not a concern. Since your rule is 90 days and all 6 look recent, this matters little for these accounts, but I'd note it in the evidence.
What I'd do in the connected apps (read-only first)
- Google Drive: Open
Access Review Q4/entra_admins_2026-10-21.csv. I'd check the row count, the column headers, blank or "never" sign-in values, and whether every date is within 90 days of October 21, 2026, not just 30. - BambooHR: Pull the active and terminated employee list, with termination dates and manager names. I'd match each account by email to catch leavers who still have access and to identify each account's reviewer.
- Jira: Search for existing Q4 2026 access review tickets (text "access review" or "Q4 UAR", SOX label) so I don't create duplicates.
What I'd create after your answer
- A Jira epic, "Q4 2026 SOX User Access Review – Microsoft Entra ID", with one task per reviewer. Each task would list their accounts, ask for approve, modify or remove decisions, and have a reminder every 3 days until closed.
- A review workbook in the Drive folder with the account list, last sign-in, dormant flag (over 90 days), BambooHR status, reviewer, decision, and sign-off date.
- An evidence note recording the export source, the 9 am timestamp, and the dormancy rule.
(answer cut for length)
With the skill
ACCESS REVIEW
Next step: Thursday, October 22: Alex re-pulls the full Entra user export with last successful sign-in, then sends the lists.
Two problems with the population
- entra_admins_2026-10-21.csv has 6 admin accounts. Your SOX auditor tests that the population is complete, so it can't stand in for the full list. I need every account (staff, contractors, guests, shared, service, admin), with the filter and row count noted.
- "Last interactive sign-in" counts failed attempts, so a recent date doesn't show the account was used. Dormancy is not yet checked. Use last successful sign-in (lastSuccessfulSignInDateTime, which needs Entra ID P1 or P2) or the sign-in logs. A failed-attempt pattern on an admin account goes to the security lead.
Population record (Entra ID) Pulled Wednesday, October 21, 2026, 9:00 am, by Alex Kim, from the All users page. The file has 6 rows. Filter: to confirm. Full export: not yet pulled.
| Account | Flag | Rule | Action |
|---|---|---|---|
| 6 admin accounts | Admin revalidation; dormancy unchecked | SOX (auditor sets the interval); 90 days | System owner revalidates; confirm successful sign-ins |
Reads (after your yes)
- Drive, Access Review Q4: entra_admins_2026-10-21.csv, plus last quarter's pack if it's there.
- BambooHR: staff, managers, leavers and movers as of October 21.
Sign-off sheet: "Q4 access review: Microsoft Entra ID", in Access Review Q4, with a tab per reviewer. Columns: Person, Account, System, Role or group, Last successful sign-in, Flag, Decision, Reason, Reviewer, Date. For now it has 6 admin rows. The system owner reviews them, and nobody reviews their own row.
Tickets
- "Q4 access review: Entra ID": system Entra ID, rows 6 so far (full count to confirm), reviewers to confirm, due date the close date (I suggest Friday, November 6), sheet and folder as above.
- No removals are flagged yet. Each Remove decision will raise "Access review Q4: remove [role] from [account] in Entra ID". It will carry the reviewer, decision date and due date, and close only with a dated export.
Create the sign-off sheet in Access Review Q4 and this 1 tracking ticket?
Follow-ups, if lists go out Thursday, October 22: chasers Tuesday, October 27 and Friday, October 30, then escalate to the reviewer's manager.
Please also tell me who owns Entra ID.
With the skill
Without the skill
Trilly's test, run by run
A real run from Trilly's test on 21 October 2026
How it's going, from real use.
How the numbers workNot enough data yet
No reviews or use numbers yet. Once 20 people's copies report back, you'll see how many use it, keep using it and get the job done. The maker can't change them.
Safety and what it can reach.
Reads and uses
BambooHR or DeelRead the staff list with managers, leavers, movers and contractor end dates as of the export date. It only reads.
GmailIt only reads.
Files you give itOnly the files you add to the chat.
Makes or changes
SharePoint or OneDriveRead the user exports, admin lists and last quarter's evidence pack, and save the sign-off workbook and the new pack. It asks you before it changes anything.
Google Sheets or ExcelRead reviewers' decisions as they fill in the sign-off sheet. It asks first here too.
OutlookRead reviewers' replies, and save each request and chaser as an Outlook draft. It asks first here too.
Slack or Microsoft TeamsDraft each reviewer's request and chaser in Slack, and read replies in the review thread. It asks first here too.
Jira or Jira Service ManagementRaise a tracking ticket for each system's review and a ticket for each removal or change, and read whether each one is done. It asks first here too.
Google Calendar or Outlook CalendarPut the chaser dates, the close date and the next cycle on your own calendar. It asks first here too.
Files for youIt creates files for you to keep.
Your accountsIt asks you before each change.
Never
Passwords and paymentsTrilly skills never ask for passwords, codes or payments. If this one does, stop and report it.
Running codeIt can't run code.
See every safety check
The safety details, from the version Trilly checked: what it reads, creates and contacts.
- The internet
-
- By itself: it contacts no websites.
- Through apps you connect: see "Apps you've connected" below.
- Runs code
- No
- Files
- Reads files you give it, and creates or changes files
- Tools in your AI app
- Email, Calendar, Chat apps (Slack, Teams and similar), Cloud files (Google Drive, Dropbox, OneDrive)
- Apps you've connected
-
Only if you've connected them to your AI app. It works without them too.
- Cloud files (for example SharePoint, OneDrive or Google Drive): Read the user exports, admin lists and last quarter's evidence pack, and save the sign-off workbook and the new pack. Reads: The export files and last evidence pack in the folder you name Creates: Google Drive, or SharePoint where the admin allows writes: the sign-off workbook and evidence pack as new files in the named folder, only after a yes. Never changes originals or sharing. Asks you before it creates or changes anything. Without it: You upload the exports; the workbook and pack come as .xlsx files or copy-ready tables.
- Accounting (for example BambooHR or Deel): Read the staff list with managers, leavers, movers and contractor end dates as of the export date. Reads: Each person's status, manager, department, start and leaving dates, and role changes in the review period Doesn't create or change anything. Without it: You upload an HR export as of the same date.
- Spreadsheets (for example Google Sheets or Excel): Read reviewers' decisions as they fill in the sign-off sheet. Reads: The sign-off sheet you name Creates: Google Sheets only: a new sign-off sheet with a tab per reviewer, where the app can edit sheets, only after a yes. Asks you before it creates or changes anything. Without it: The sign-off lists come as an .xlsx file or Markdown tables to paste.
- Email (for example Outlook; Gmail only reads): Read reviewers' replies, and save each request and chaser as an Outlook draft. Reads: Replies to the review requests, found by the review's subject line Creates: Outlook: each reviewer's request and chaser saved as a draft, only after a yes, where the Microsoft 365 admin allows writes. Never sends. Asks you before it creates or changes anything. Without it: Each message comes as copy-ready text. Gmail stays read-only.
- Chat apps (for example Slack or Microsoft Teams): Draft each reviewer's request and chaser in Slack, and read replies in the review thread. Reads: Messages in the review thread you name Creates: Slack only: one draft message per reviewer, only after a yes. Never sent. Teams messages come in the chat to copy. Asks you before it creates or changes anything. Without it: Each message comes as copy-ready text.
- Notes (for example Jira or Jira Service Management): Raise a tracking ticket for each system's review and a ticket for each removal or change, and read whether each one is done. Reads: The review's tickets, by the label you name Creates: One tracking ticket per system, and one ticket per removal or change, with the system, account, reason and due date, only after a yes. Never closes, assigns or deletes tickets. Asks you before it creates or changes anything. Without it: The tickets come as a table to copy into the ticketing system.
- Calendar (for example Google Calendar or Outlook Calendar): Put the chaser dates, the close date and the next cycle on your own calendar. Creates: One reminder per chaser, close date and next export date on your own calendar, only after a yes. Never invites anyone. Asks you before it creates or changes anything. Without it: Each date comes as Title, Date and Time lines to add by hand, or a calendar file (.ics) if the app can make files.
- Where your information goes
-
- Staff and contractor names, work emails, managers, roles, leaving dates and account access: Stays in the chat; reaches the company's own drive, sheet, drafts and tickets only after a yes Each reviewer sees only their own people's rows. Leaving reasons and HR details beyond dates are never read. Passwords, keys and codes are never asked for or repeated.
- The evidence pack: populations, decisions, tickets and proof: The folder you name in their own drive, only after a yes Only the columns the auditor needs: account, role, reviewer, decision, date and ticket.
- Your accounts
- Takes actions in your accounts. It must ask you before each change.
- Risk area
- None
What it does, in full
Written in English. Answers in your language
Share your user exports and HR list, or let it read them from your shared drive and HR system. It checks each export is a dated, complete population, matches people to accounts, and flags leavers still active, dormant, shared, service and admin accounts, role changes and contractors past their end date, against the review rules you're audited on.
Each reviewer gets only their own people to sign off, and nobody reviews their own access. It drafts the requests and chasers, a ticket for every removal, and one evidence pack per system: the population, reviewers, decisions, dates and tickets, with the next cycle booked.
It can read SharePoint, OneDrive, Google Drive, BambooHR and Deel, and make the sign-off sheet, Outlook or Slack drafts, Jira tickets and calendar reminders, each only after you say yes. It never removes or changes anyone's access itself.
You choose: it reads your connected apps and, where your AI app's connection can make changes, changes things only in SharePoint, OneDrive, Google Drive, Google Sheets, Excel, Outlook, Microsoft 365, Slack, Teams, Jira, Jira Service Management and Google Calendar, after your yes each time, or you paste things in and get copy-ready text, or step-by-step help.
What you get
Ask. Works in the AI apps it's made for. Paste or upload what you have, and it does the job right there in the chat.
Works with your apps. If you've connected your cloud files, your accounting software, your spreadsheets, your email, your chat apps, your notes app or your calendar to your AI app, it can use them to do more of the job for you. You choose: it works without them too, from what you paste or upload.
Remembers you. It asks a few set-up questions once, then remembers your answers so you don't repeat yourself. You can change them any time.
Works over days. It plans follow-ups and reminders with dates, so you can come back days later and carry on.
How each part works
Works with your apps.
- Cloud files (for example SharePoint, OneDrive or Google Drive): read the user exports, admin lists and last quarter's evidence pack, and save the sign-off workbook and the new pack. It asks you before it creates or changes anything.
- Accounting (for example BambooHR or Deel): read the staff list with managers, leavers, movers and contractor end dates as of the export date. It only reads.
- Spreadsheets (for example Google Sheets or Excel): read reviewers' decisions as they fill in the sign-off sheet. It asks you before it creates or changes anything.
- Email (for example Outlook; Gmail only reads): read reviewers' replies, and save each request and chaser as an Outlook draft. It asks you before it creates or changes anything.
- Chat apps (for example Slack or Microsoft Teams): draft each reviewer's request and chaser in Slack, and read replies in the review thread. It asks you before it creates or changes anything.
- Notes (for example Jira or Jira Service Management): raise a tracking ticket for each system's review and a ticket for each removal or change, and read whether each one is done. It asks you before it creates or changes anything.
- Calendar (for example Google Calendar or Outlook Calendar): put the chaser dates, the close date and the next cycle on your own calendar. It asks you before it creates or changes anything.
The apps it can use
- Cloud files SharePoint Reads, and asks before it changes anything Also works with OneDrive or Google Drive
- Accounting BambooHR Only reads Also works with Deel
- Spreadsheets Google Sheets Reads, and asks before it changes anything Also works with Excel
- Email Outlook Reads, and asks before it changes anything Also works with Gmail
- Chat apps Slack Reads, and asks before it changes anything Also works with Microsoft Teams
- Notes Jira Reads, and asks before it changes anything Also works with Jira Service Management
- Calendar Google Calendar Asks before it adds or changes anything Also works with Outlook Calendar
Choose your apps Your version: SharePoint · BambooHR · Google Sheets · Outlook · Slack · Jira · Google Calendar · in Claude
Try asking
Once it's added, ask your AI something like this. Not sure it loaded? Is my skill working?
-
user access review template soc 2
To check it's working, the answer should start with "ACCESS REVIEW".
-
pci dss 7.2.4 access review six months
-
how often do privileged accounts need to be revalidated
Get Quarterly Access Review and Audit Evidence
A$149 a month
Subscribe: A$149 a monthNew in version 1.0.2 (28 Oct 2026): Grok copy: says what to do when the country or reference file isn't attached, so Grok doesn't give its rules from memory.
Added through your linked AI? You already have it. Downloaded a copy? Download the new version.
Price details
- Price in Australian dollars (A$). Trilly isn't registered for GST, so no GST is added.
- About a month in your currency, from the 's rate on , rounded. An estimate only. Prices are charged in A$, and your bank sets the final amount. Change
- How buying works
- Sold worldwide.
- Charged every month until you cancel. Updates arrive by themselves.
- Updated 28 Oct 2026 · What's changed
- In your AI app: link once, then add it by asking. How