Know who can access what,
and prove it to auditors
One console to manage, review and audit who can access what, across Active Directory, Entra ID and Microsoft 365, for the help desk, security teams and data owners.
What X-Access does
Administration and access governance in one product.
Everyday AD work, delegated
Reset, unlock, enable, move and change groups in seconds. Limit each help desk user to the OUs they look after.
Joiners, movers and leavers
Role templates, mirror user, bulk CSV with a preview, and one-step offboarding that disables, strips groups and moves the account.
Requests with approval
Staff ask for access, an approver decides, and X-Access makes the change in AD and records who asked, who approved and what changed.
Who has access to what
Scan file share permissions and see each person's effective access, directly or through which group.
Reviews by data owners
Business managers confirm or revoke access to their data: the evidence auditors ask for under SOX, ISO 27001 and PCI DSS.
Risk you can explain
Every account gets a risk score with its reasons. Alerts fire when someone joins Domain Admins or an account appears outside the process.
Evidence without the spreadsheet
Everything an auditor asks for, recorded as it happens.
Complete audit trail
Every change with who, when, IP address and before and after values, including changes made in AD outside X-Access.
Reports and compliance checks
Stale accounts, old passwords and privileged members in CSV or PDF, emailed on a schedule, with SOX, HIPAA, PCI DSS and GDPR checks.
Backup, restore and self-service
Daily AD snapshots restore an account's attributes and lost groups. Staff reset their own Windows password with an emailed code.
Installed in your network; your data stays on site
Runs on a domain-joined Windows Server with Node.js 20+ and PostgreSQL. Connects to Active Directory over LDAP or LDAPS across several domains, to Microsoft Entra ID and Microsoft 365 licences, and to any SMTP server. Your logo and colours, in English, 简体中文 and العربية.
Start with a pilot
Connect one domain, scan your most sensitive file share, and run its first access review.