Access requests people love.
Evidence auditors trust.
Warde puts access requests, approvals and reviews in your ServiceNow portal, looking like the rest of it. Behind every screen, all access is approved by a named person and every removal is confirmed, so you know who can reach what and can prove it.
Works with SailPoint, Saviynt, Okta and Microsoft Entra, with no ID Governance add-on needed, or with ServiceNow tasks where you have no engine.
It looks and feels like the rest of your portal.
Every screen lives in your ServiceNow portal, where your staff already order laptops and book leave. Plain names, one place to ask, nothing new to log in to and nothing to learn.
Ask for access like ordering anything else
Search by name and put several applications in one request. The form only offers what you can be given, marks what you already hold, and names your approver before you submit.
A new starter's access in one request
Pick the bundle for the job, add as many starters as you need, and accept the terms once. Anything someone sets up by hand is flagged, so nobody is surprised by the wait.
A review a line manager can finish
Keep or take away, one row at a time or several at once, with each row saying how the person got that access. Away or unsure? Delegate the review, or pass it to a colleague who knows the team.
Your IAM team runs it, with no developer
Guided Setup takes you from install to live, and each step checks the instance as you go. Wizards then bring each new application on board and change who approves what, with no update sets.
Start from wherever you are.
Most customers arrive in one of three places. Warde fits each one without asking you to change the identity system you have.
Typically 1,000 to 10,000 staff
Entra, and no governance product
Microsoft 365 and Entra, with reviews in a spreadsheet. Warde changes Entra groups, app roles and licences itself, so you get requests, approvals and reviews without buying Entra ID Governance or a suite. Groups synced from Active Directory change through a MID Server, and everything outside Entra goes as a ServiceNow task. Entra · Access requests
Typically 3,000 to 15,000 staff
Saviynt or Entra ID Governance
ServiceNow reaches your engine through a vendor plugin or a connector built years ago. Warde puts asking and reviewing in your ServiceNow portal and hands the change over on a supported connector. Entra · Saviynt
Typically 15,000 staff and up
SailPoint
IdentityIQ or Identity Security Cloud, joined to ServiceNow by something built years ago. Warde replaces it with a supported connector and adds reviews decided in ServiceNow. SailPoint
Evidence an auditor can test.
The most common IT weakness a public company discloses is somebody's access. Warde answers the three questions an auditor asks about it, from records nobody can edit or delete.
Was it approved first?
Every piece of access names who approved it, when, and the rule that sent it to them. Conflicting access is caught on the form, before anyone approves.
Was it really removed?
A removal is done only when the system that made it confirms it. Leavers and review revocations go down the same path.
Was the review complete?
A campaign freezes its scope and reviewers the moment it starts, so you can show exactly what was in front of each reviewer.
Role-based access, without the 18‑month role project.
Your teams build a bundle for each job in your ServiceNow portal. The owners sign it off once, and from then on a new starter needs one request and one approval. A study for NIST published in 2010 found a role programme took about 18 months and cost a 10,000-person company US$2.4 million, in 2009 dollars.
An accounts payable starter, without a bundle
6 requests · 11 approvals
- SAP Accounts Payable
- Invoice inbox
- Finance SharePoint
- Accounts payable mailbox
- Finance reports
- GlobalProtect VPN
The same starter, with the bundle
1 request · 1 approval
- Every item pre-approved by its owner
- The manager approves once
- High-risk items still ask their own approvers
- Reviewed later as one decision
- Hand it out from your HR feed when you are ready
An agent inherits the access of whoever ran it.
Copilots and MCP clients act with the user's own permissions. Every piece of access someone should have lost three roles ago is now reachable by software acting in their name. Keeping human access correct is what Warde does, and it is what an agent borrows.
Works with the identity system you own, or with none.
Every connector is included, and on Microsoft Entra you need no ID Governance licence. Where there is no engine, the work goes as a ServiceNow task to the team that owns the application.
What each vendor’s ServiceNow application does on your instance.
A tick means the work happens in ServiceNow. A dash usually means the vendor does it well in its own console.
| In ServiceNow | Warde | SailPoint | Saviynt | Entra |
|---|---|---|---|---|
| Ask for access in the ServiceNow catalog | yes | yes | yes | yes |
| Approve it in ServiceNow | yes | yes | yes | yes |
| Checked before it is sent: separation of duties, terms of use and the owner’s notes | yes: terms of use and the owner’s notes wherever they are set, and the separation-of-duties verdict where SailPoint checks it | partly: separation of duties is checked on the form, set to warn or block; terms of use and owner’s notes are not documented | partly: the requester sees possible separation-of-duties conflicts; terms of use and owner’s notes are not documented | not documented in ServiceNow: Entra checks incompatible access packages in its own My Access portal |
| Your identity engine does the provisioning | yes | yes | yes | yes |
| Time-bound access: an end date on the request, within a limit you set, with a warning before it ends | yes | partly: a sunset date on the form, which can be made mandatory; Identity Security Cloud removes the access and emails its own reminders | partly: start and end dates on the request; who removes the access, and any warning, are not documented | partly: a duration on the request where the access package allows one; Entra removes the access, and its reminder email is off by default |
| Removing access in ServiceNow, by the holder or their manager, confirmed back | yes | partly: a manager can remove a direct report’s access, but people cannot remove their own over the usual connection | partly: a Remove access item, with the request updated once Saviynt completes it; who may remove for whom is not documented | partly: people can remove their own access packages; removal by a manager is not documented |
| User access reviews decided in ServiceNow | yes | yes, for Identity Security Cloud: SailPoint documents a certification portal in ServiceNow where certifiers approve, revoke and sign off | no | no |
| Campaigns defined and scheduled in ServiceNow | yes | their console | their console | their console |
| Approval policies built in ServiceNow | yes | no | no | no |
| Access bundles curated in ServiceNow | yes | no | no | no |
| My Access: one page for what you and your team hold, and the reviews waiting on you | yes | partly: the app shows the roles and access profiles a person holds, without a team view or reviews on the same page | not stated | their console |
| An admin workspace on the instance: what is stuck, what is stale, connector health | yes | not stated | not stated | no |
| The auditor’s evidence pack, in ServiceNow | yes | no | no | no |
| Runs with no identity engine at all | yes | no | no | no |
| Spots the joiner and the leaver for you | not on its own: your own joiner and leaver trigger calls Warde’s lifecycle endpoint, and Warde provisions from there | yes | yes | yes |
How we read the vendors
Read from each vendor’s published documentation and ServiceNow Store listing in September and October 2026. On the rows for checks, end dates and removals, “partly” means the vendor documents part of it, such as a separation-of-duties check on the form with no terms of use. For SailPoint on the My Access row, “partly” means the app shows what a person holds, without the team view or the reviews waiting. SailPoint’s tick on user access reviews is for Identity Security Cloud’s Service Catalog app, which needs its own SailPoint licence: reviewers decide their campaign items and sign off in ServiceNow, while the campaign is built and scheduled in Identity Security Cloud. The IdentityIQ integration does not include it. On the last row, Warde does not watch your HR feed. Whichever system already knows somebody has joined or left calls Warde’s lifecycle endpoint, and Warde grants or removes the access from there. The full sixty-three-row version, sources attached, is yours if you ask for it.
Nothing to host. No Warde cloud.
One scoped app in your own instance. There is no vendor cloud and no middleware, so the record of who holds what stays on your instance. How Warde handles your data.
- Runs on your instance
- Installed from the Store as one versioned release. Your platform team already knows how to run it.
- Survives an engine change
- Approval policies, owners and the audit history live in ServiceNow, so moving to a new identity system doesn’t start you from zero.
- Outbound only
- Calls your identity system on credentials held in your instance. Nothing calls in.
- AI ready, with no AI licence needed
- It works the same without Now Assist. If you have Now Assist for Virtual Agent, Warde ships Request Access (Simple), a conversational version of the request form that asks for one item for one person a turn at a time; switch it on once Now Assist and AI Search are set up. ServiceNow’s MCP support can also put Warde’s REST API in front of your assistants, working as the person signed in.
The business case
US$250k+
a year of time back for a 10,000-person company, once most joiners and movers have a bundle. The subscription pays for itself in under three months.
| Where it comes from | Hours | Value |
|---|---|---|
| Service desk time on access requests | 2,625 | US$118,000 |
| Asking, approving, and new starters waiting | 2,230 | US$100,000 |
| Bundles: 4,100 fewer approvals | 1,110 | US$50,000 |
| High-risk reviews run as campaigns | 310 | US$14,000 |
| A year | 6,275 | US$282,000 |
How each line is worked out
All at US$45 an hour. Service desk: 8,750 access requests a year at 40 minutes, 45 percent taken out by connectors and named tasks. Business time: requesters, approvers, managers deciding what a joiner needs, and half a day a new starter loses to missing access. Bundles: four in five joiners and movers on bundles, less the time to build and keep 100 of them. Reviews: 38 applications a quarter, three hours each by hand, 45 minutes as a campaign.
Every business-side figure is an assumption set low on purpose. Swap in your own before taking it to a budget holder. Sources: Fixify 2026 IT Help Desk Benchmark, ESG (now Omdia), RTI International for NIST, Ponemon for GuidePoint, HDI, Gartner.
Built and running, waiting on Store certification.
Working today
- Access requests, removals and approval policies
- Copy from a person: start a request from what a colleague holds
- Access bundles, requested or handed out from your HR feed
- User access reviews and the evidence pack
- Guided Setup, from install to live, checking the instance at each step
- My Access: one portal page for everything a person and their team hold, and the reviews waiting on them
- SailPoint Identity Security Cloud, IdentityIQ, Microsoft Entra and Saviynt connectors, and Okta read with changes sent as tasks
- Joiners, movers and leavers through one API
- End dates, with warnings before access is removed
- Groups synced from Active Directory, changed through a MID Server
- AI assistants such as Claude look up, request, remove and review access through the Warde API, with guided steps to connect them over MCP
Coming soon
- Active Directory groups that are not synced to Entra, through a MID Server
- Separation of duties rules kept in Warde for Entra and Active Directory, with signed exceptions
- SailPoint and Saviynt roles carried over to Entra as Warde bundles
- Review lines that show last use, unusual access and conflicts, with a suggested decision
- A review of what a person asked for in their old job, before they move
- Extra accounts, such as an admin account, and Entra guests from partner organisations
- End dates on a whole bundle
- Privileged access for a set time window
- Licence limits from SAM Pro on requests and approvals
Need something on neither list? Tell us. Releases are short and the people who ask set the order.
Warde
Middle English, said ward
In medieval England, warde was the keeping of something on another’s behalf: the watch on a city gate, or the custody of an heir and his lands until he came of age. Whoever held the warde answered for who went in. That is the whole idea: keep watch over who can reach what, and answer for every key handed out.
Bring the access request you hate most.
Forty-five minutes on a live instance, with no slides. We'll show you what replaces it, what it costs, and what the product still can't do.
Warde is priced per user. Book a walkthrough or get in touch for a quote.