Account review is a defensive check of user and service accounts for unusual logins, unexpected permissions, new sessions, or suspicious changes. Security teams use it to confirm whether access still matches business need and whether any account has been abused.
It matters because stolen credentials, phished passwords, and misused vendor access are common attack paths. In an incident, reviewers may compare sign-in logs, MFA events, privilege changes, and admin actions to spot anomalies. They also check dormant accounts, shared accounts, and third-party access that should be removed. A timely account review can limit damage, reveal compromised access early, and support incident response without assuming a breach has been confirmed.