How to compare user access lists safely

1. Choose the matching field

Use an immutable employee or account ID where possible. Email is usually safer than display name when an ID is unavailable.

2. Prepare comparable sources

Export the same access scope from both systems and note the date, environment, and role filter used for each list.

• Use exports created for the same scope and approximate date.
• Keep the original source files untouched for audit and recovery.
• Compare one meaningful field at a time instead of mixing identifiers.

3. Normalize intentionally

Trim accidental whitespace and choose case-insensitive matching only if the identity system treats email case as irrelevant. Never remove leading zeroes from account IDs unless you know they are formatting only.

4. Review the result before acting

Start with the two Only lists: they form the access-review queue. Have the system owner verify each difference rather than treating a list diff as an automatic provisioning command.