The annual access review process that involves pulling Box reports, running PowerShell against AD, compiling spreadsheets, and emailing them to managers for review is one of those IT workflows that everyone knows is inefficient but keeps doing because it works well enough to get through the audit. Until it doesn't, or until the scope grows, or until someone asks how you know the managers actually reviewed the list rather than just clicking through it.

If you're evaluating tooling for AD, Office 365, and Box access reviews, you're in a well-established problem space — but the Box-specific piece is genuinely less well-covered than the AD and Microsoft tools. Here's what the landscape looks like.

Why Box Is the Hard Part

Active Directory and Office 365/Entra ID are the most commonly covered systems in access review tooling. Nearly every platform in this category has AD and Microsoft connectors, and Microsoft's own Entra ID access reviews handle the Microsoft ecosystem natively for organizations already in that ecosystem.

Box is where the coverage gets thinner. Box is a third-party SaaS platform with its own user model — Box users, Box groups, collaborations, and content access permissions — that exists somewhat separately from your AD/Entra ID identity stack. Some organizations have Box connected via SSO so that Entra ID or Okta manages authentication, but the internal Box permission structure (who can access which folders, at what permission level, as a collaborator or owner) often requires going directly to Box's API to get meaningful data rather than just the SSO-level user presence.

The tooling gap you noticed in prior threads reflects this: platforms that cover AD and Office 365 comprehensively sometimes treat Box as an afterthought — connecting via SSO integration to confirm user existence but not pulling the deeper Box-specific access data that makes the review meaningful.

What Box-Specific Integration Actually Requires

For a Box access review to be useful rather than just a presence check, the integration needs to pull:

Users and roles — which Box users exist, whether they're active, and what their administrative role is (Admin, Co-Admin, standard user).

Group memberships — which Box groups each user belongs to, since groups often drive folder access and collaboration permissions.

Collaboration access — which folders and content each user or group has been shared on, and at what permission level (Viewer, Editor, Co-Owner, Owner). This is the most access-relevant data and also the most granular.

Activity data — when each user last accessed Box, which informs the dormancy checks that help reviewers make meaningful decisions rather than rubber-stamping.

Getting all of this requires a direct Box API integration using Box's Content API and User API, not just an SSO-level connection. Platforms that claim Box support are worth testing specifically on whether they pull collaboration-level access data or just user existence.

The Tools You're Already Looking At

SailPoint covers Box and has an established connector. As with the AD and Office 365 integrations, the depth and maintenance of the Box connector depends on which SailPoint product you're evaluating (ISC vs. IIQ) and which version of the connector is current. SailPoint's implementation complexity and timeline are the known tradeoffs — this is the right choice if you need the depth of a full IGA platform and have the budget and timeline for it.

SecurEnds is specifically focused on access reviews and certification workflows, with multi-system support including Box. Worth evaluating specifically for the Box coverage depth — whether it pulls role and activity data or just user lists.

Netwrix is primarily known for AD and file server auditing and has access governance features. The file server piece of your requirement is a specific strength. Box coverage is available but worth testing for depth.

StealthBits / Netwrix Threat Prevention (now merged under the Netwrix umbrella) similarly focuses on AD and file server environments. Good fit for the on-prem piece, Box coverage less comprehensive.

Security Explorer is primarily an AD and Windows infrastructure tool. Less relevant for the Box component.

Zluri is a next-generation IGA platform with direct Box API integration — pulling users, roles, groups, and activity data — alongside AD (via a lightweight on-premises agent for LDAP/LDAPS) and Office 365/Entra ID. The review workflow routes tasks to reporting managers automatically, provides last-used data in the reviewer interface, and triggers deprovisioning via Box API when access is revoked. Deployment timeline is typically four to twelve weeks versus the months-long implementations that legacy platforms require.

The Microsoft-Native Option

If your environment is deeply Microsoft-integrated, Entra ID access reviews (included with Entra ID P2 licensing) handle the Office 365 and Entra-connected portions of your review natively. The workflow is functional — manager-based reviewer assignment, approve/deny decisions, and some remediation automation for Entra-connected applications.

The limitation is scope: Entra ID access reviews cover what's connected to Entra ID. Your on-premises file servers need a separate approach, and Box requires either a separate integration or a third-party tool. For organizations that are fully cloud and Microsoft-stack, native Entra ID reviews are worth evaluating before spending on a third-party platform. For environments like yours where Box is a significant piece of the review scope, you'll likely need tooling that goes beyond what Microsoft provides natively.

What the Ideal Workflow Looks Like

The goal you're working toward is replacing the PowerShell + spreadsheet process with something that:

Pulls current user and access data directly from Box, AD, and Office 365 without manual export steps — so the review starts with current data rather than a point-in-time snapshot that's already drifting.

Routes review tasks automatically to managers based on reporting relationships pulled from AD or your HRMS — no manual assignment, no distributing spreadsheets.

Presents managers with enough context to make real decisions — specifically last-login and activity data for Box, so a manager can see that a user hasn't accessed Box in six months and make an informed revocation decision rather than approving by default.

Executes revocations automatically when a manager marks access for removal — removing the user from Box via API rather than generating a list for IT to action manually.

Produces evidence that satisfies auditors — a non-editable, timestamped report documenting who reviewed, what decision was made for each record, and confirmation that revocations were executed.

The specific evaluation test for any platform you're considering: ask them to demo the Box integration end-to-end — from data pull through reviewer interface through deprovisioning — rather than just confirming that Box is in their supported connector list. The depth of what's actually pulled from Box varies significantly and is the difference between a meaningful access review and a presence check.

The File Server Question

Your file server requirement deserves a separate note. On-premises file server access governance — who has access to which shares and folders — is its own technical challenge that's different from SaaS application reviews. Most SaaS-focused IGA platforms cover it through either an AD group-based review (reviewing the AD groups that control file server access rather than the file server directly) or through a lightweight agent that can query share and folder permissions.

If granular file server access review — down to the folder level — is a core requirement rather than just reviewing the AD groups that govern file server access, platforms with dedicated file server governance capabilities (Netwrix is the most common recommendation here) are worth looking at alongside the more SaaS-focused options.

For most environments, reviewing the AD groups that control file server access, combined with a separate file server audit report, is sufficient for annual access review purposes without requiring a platform that does folder-level file governance natively.