Skip to content

Sentry access control & privilege security checks

Admin roles, standing privileges, permission scopes and policy enforcement — the settings that decide how much damage one compromised account can do.

On Sentry, Black Cat runs 18 checks in this area on every scan. Each one below lists its severity, how to fix it, and the compliance controls it satisfies where a control applies. See what access the Sentry connector needs.

Checks (18)

severity: high SSO Disabled fix difficulty: medium #

Enable SSO for the Sentry organization via a SAML2 or OAuth identity provider

  1. Sign in to Sentry as an organization owner or admin
  2. Navigate to Settings > Auth (https://sentry.io/organizations/<org>/settings/auth/)
  3. Click "Configure" next to the desired SSO provider (e.g. SAML2, Google, GitHub)
  4. Follow the provider-specific configuration wizard and supply IdP metadata or client credentials
  5. Save the configuration and verify SSO login works with a test account
  6. Optionally enforce SSO by enabling "Require SSO" to prevent password-based logins

Vendor docs ↗

Satisfies: ISO 27001:2022 A.5.15 SOC 2 Type II CC6.1 CIS Controls v8 CIS-06.1 NIST CSF 2.0 PR.AA-05 GDPR (SaaS Security) GDPR-25.1 HIPAA (SaaS Security) HIPAA-312.d NIS2 Directive NIS2-21.i.1 DORA (SaaS Security) DORA-9.2

severity: medium Default Role Not Member fix difficulty: easy #

Set the default organization member role to "member" to enforce least privilege

  1. Sign in to Sentry as an organization owner or admin
  2. Navigate to Settings > General (https://sentry.io/organizations/<org>/settings/)
  3. Locate the "Default Role" field under the Organization Settings section
  4. Change the value to "Member"
  5. Click "Save Changes" to apply the new default role

Vendor docs ↗

Satisfies: ISO 27001:2022 A.5.15 SOC 2 Type II CC6.1 CIS Controls v8 CIS-06.1 NIST CSF 2.0 PR.AA-05 GDPR (SaaS Security) GDPR-25.2 HIPAA (SaaS Security) HIPAA-312.a NIS2 Directive NIS2-21.i.1 DORA (SaaS Security) DORA-9.2

severity: medium Excessive Admins fix difficulty: medium #

Reduce the number of admin-level members to the minimum required for operations

  1. Sign in to Sentry as an organization owner
  2. Navigate to Settings > Members (https://sentry.io/organizations/<org>/settings/members/)
  3. Filter or sort members by role to identify all admins, managers, and owners
  4. For each unnecessary elevated account, click the member name and change the role to "member" or an appropriate lower role
  5. Remove any admin accounts that belong to former employees or service accounts no longer needed
  6. Click "Save" after each role change

Vendor docs ↗

Satisfies: ISO 27001:2022 A.5.15 SOC 2 Type II CC6.1 CIS Controls v8 CIS-06.1 NIST CSF 2.0 PR.AA-05 GDPR (SaaS Security) GDPR-25.2 HIPAA (SaaS Security) HIPAA-312.a NIS2 Directive NIS2-21.i.1 DORA (SaaS Security) DORA-9.2

severity: medium Dormant User fix difficulty: easy #

Remove or deactivate dormant member accounts that have not been active recently

  1. Sign in to Sentry as an organization owner or admin
  2. Navigate to Settings > Members (https://sentry.io/organizations/<org>/settings/members/)
  3. Identify members flagged as dormant (no recent login activity)
  4. For each dormant account, click the member row and select "Remove from Organization" or downgrade the role
  5. Confirm the removal in the dialog
  6. Notify the member if the removal was unintentional

Vendor docs ↗

Satisfies: ISO 27001:2022 A.5.15 SOC 2 Type II CC6.1 CIS Controls v8 CIS-06.1 NIST CSF 2.0 PR.AA-05 GDPR (SaaS Security) GDPR-25.2 HIPAA (SaaS Security) HIPAA-308.a3 NIS2 Directive NIS2-21.i.1 DORA (SaaS Security) DORA-9.2

severity: medium Old Pending Invite fix difficulty: easy #

Revoke stale pending invitations that have not been accepted within a reasonable timeframe

  1. Sign in to Sentry as an organization owner or admin
  2. Navigate to Settings > Members (https://sentry.io/organizations/<org>/settings/members/)
  3. Filter the member list to show "Invited" or pending status entries
  4. For each invitation older than 7 days, click the entry and select "Revoke Invite"
  5. Confirm revocation in the dialog
  6. Re-invite the intended recipient if access is still required

Vendor docs ↗

Satisfies: ISO 27001:2022 A.5.15 SOC 2 Type II CC6.1 CIS Controls v8 CIS-06.1 NIST CSF 2.0 PR.AA-05 GDPR (SaaS Security) GDPR-25.2 HIPAA (SaaS Security) HIPAA-312.a NIS2 Directive NIS2-21.i.1 DORA (SaaS Security) DORA-9.2

severity: medium Inactive Admin fix difficulty: easy #

Remove or downgrade admin accounts that have been inactive for more than 90 days

  1. Sign in to Sentry as an organization owner
  2. Navigate to Settings > Members (https://sentry.io/organizations/<org>/settings/members/)
  3. Identify admin-level members with no recent login activity
  4. Contact the account owner to confirm whether the elevated role is still needed
  5. If the admin role is no longer required, click the member and change the role to "member"
  6. If the account belongs to a former employee, remove them from the organization entirely

Vendor docs ↗

Satisfies: ISO 27001:2022 A.5.15 SOC 2 Type II CC6.2 NIS2 Directive NIS2-21.i.1 DORA (SaaS Security) DORA-9.2

severity: low Expired Invitation Not Removed fix difficulty: easy #

Clean up expired invitations to keep the member list accurate and reduce confusion

  1. Sign in to Sentry as an organization owner or admin
  2. Navigate to Settings > Members (https://sentry.io/organizations/<org>/settings/members/)
  3. Filter the list to show expired invitations
  4. For each expired entry, click "Revoke" or remove the invitation record
  5. Re-invite the intended recipient with a fresh invitation if access is still required

Vendor docs ↗

Satisfies: ISO 27001:2022 A.5.15 SOC 2 Type II CC6.2 NIS2 Directive NIS2-21.i.1 DORA (SaaS Security) DORA-9.2

severity: medium Events Member Admin Disabled fix difficulty: easy #

Enable event admin access for members so they can manage event visibility within their projects

  1. Sign in to Sentry as an organization owner or admin
  2. Navigate to Settings > General (https://sentry.io/organizations/<org>/settings/)
  3. Locate the "Events Member Admin" or equivalent toggle under the Permissions section
  4. Enable the setting to allow members to administer event data in their teams
  5. Click "Save Changes" to apply
  6. Review team memberships to ensure only appropriate users are project members

Vendor docs ↗

Satisfies: ISO 27001:2022 A.5.15 SOC 2 Type II CC6.3 NIS2 Directive NIS2-21.i.1 DORA (SaaS Security) DORA-9.2

severity: medium Alerts Member Write Enabled fix difficulty: easy #

Restrict alert rule creation and modification to admin or manager roles

  1. Sign in to Sentry as an organization owner or admin
  2. Navigate to Settings > General (https://sentry.io/organizations/<org>/settings/)
  3. Locate the "Alerts Member Write" or equivalent toggle under the Permissions section
  4. Disable the setting to prevent regular members from creating or modifying alert rules
  5. Click "Save Changes" to apply
  6. Audit existing alert rules to ensure none were created by unauthorized members

Vendor docs ↗

Satisfies: ISO 27001:2022 A.5.15 SOC 2 Type II CC6.3 NIS2 Directive NIS2-21.i.1 DORA (SaaS Security) DORA-9.2

severity: medium Long-Term Inactive Member fix difficulty: easy #

Remove members who have been inactive for over a year as they likely never actively used the account

  1. Sign in to Sentry as an organization owner or admin
  2. Navigate to Settings > Members (https://sentry.io/organizations/<org>/settings/members/)
  3. Identify members flagged as inactive for more than 365 days
  4. Verify with your team or HR that the account is no longer needed
  5. Click the member row and select "Remove from Organization"
  6. Confirm the removal and notify the user if appropriate

Vendor docs ↗

Satisfies: ISO 27001:2022 A.5.15 SOC 2 Type II CC6.2 NIS2 Directive NIS2-21.i.1 DORA (SaaS Security) DORA-9.2

severity: medium Deactivated Member Not Removed fix difficulty: easy #

Remove deactivated accounts that still retain organization membership to prevent unauthorized access

  1. Sign in to Sentry as an organization owner or admin
  2. Navigate to Settings > Members (https://sentry.io/organizations/<org>/settings/members/)
  3. Identify members with an inactive or deactivated account status
  4. Verify the account is no longer in use and belongs to a former or inactive user
  5. Click the member row and select "Remove from Organization"
  6. Confirm the removal to revoke all residual access rights

Vendor docs ↗

Satisfies: ISO 27001:2022 A.5.15 SOC 2 Type II CC6.2 NIS2 Directive NIS2-21.i.1 DORA (SaaS Security) DORA-9.2

severity: high Owner Role Review fix difficulty: easy #

Review owner-role accounts and demote to admin or member where full owner privileges are not needed

  1. Sign in to Sentry as an organization owner
  2. Navigate to Settings > Members (https://sentry.io/organizations/<org>/settings/members/)
  3. Identify all members with the owner role
  4. Determine whether each owner truly needs full owner privileges (billing, SSO config, org deletion)
  5. Demote unnecessary owners to admin or member role
  6. Click Save after each role change

Vendor docs ↗

Satisfies: NIS2 Directive NIS2-21.i.1 DORA (SaaS Security) DORA-9.2

severity: high Pending Admin Invite fix difficulty: easy #

Revoke pending admin-level invitations that have not been accepted to prevent invite link misuse

  1. Sign in to Sentry as an organization owner
  2. Navigate to Settings > Members (https://sentry.io/organizations/<org>/settings/members/)
  3. Filter the member list to show pending invitations with admin, manager, or owner roles
  4. For each pending admin invite, determine if the invitation is still needed
  5. Click Revoke Invite for unnecessary or stale admin invitations
  6. Re-invite with a member role if the user does not need admin access

Vendor docs ↗

Satisfies: NIS2 Directive NIS2-21.i.1 DORA (SaaS Security) DORA-9.2

severity: medium Inactive Member 90 Days fix difficulty: easy #

Remove or downgrade regular member accounts inactive for more than 90 days

  1. Sign in to Sentry as an organization owner or admin
  2. Navigate to Settings > Members (https://sentry.io/organizations/<org>/settings/members/)
  3. Identify non-admin members with no recent login activity
  4. Contact the account owner to confirm whether access is still needed
  5. Remove members who no longer require access
  6. Consider downgrading roles if partial access is still needed

Vendor docs ↗

Satisfies: NIS2 Directive NIS2-21.i.1 DORA (SaaS Security) DORA-9.2

severity: critical Default Role Elevated to Admin or Owner fix difficulty: easy #

Change the default organization role from admin or owner to member to prevent automatic privilege escalation

  1. Sign in to Sentry as an organization owner
  2. Navigate to Settings > General (https://sentry.io/organizations/<org>/settings/)
  3. Locate the Default Role field under Organization Settings
  4. Change the value from admin or owner to member
  5. Click Save Changes to apply
  6. Review recently joined members to verify they do not have unintended admin access

Vendor docs ↗

Satisfies: NIS2 Directive NIS2-21.i.1 DORA (SaaS Security) DORA-9.2

severity: medium Expired Admin Invite Not Cleaned Up fix difficulty: easy #

Remove expired admin-level invitations to keep the member list clean and reduce confusion

  1. Sign in to Sentry as an organization owner
  2. Navigate to Settings > Members (https://sentry.io/organizations/<org>/settings/members/)
  3. Filter the list to show expired invitations with admin, manager, or owner roles
  4. Click Revoke or remove each expired admin invitation
  5. Re-invite with appropriate role if access is still required

Vendor docs ↗

Satisfies: NIS2 Directive NIS2-21.i.1 DORA (SaaS Security) DORA-9.2

severity: high Admin Redundancy Missing fix difficulty: easy #

Add a second admin-level account to prevent lockout if the sole admin is unavailable

  1. Sign in to Sentry as the organization owner
  2. Navigate to Settings > Members (https://sentry.io/organizations/<org>/settings/members/)
  3. Identify a trusted team member to promote to admin or owner
  4. Click the member row and change the role to admin
  5. Ensure the new admin enrolls in 2FA before granting elevated access
  6. Click Save to apply the role change

Vendor docs ↗

Satisfies: NIS2 Directive NIS2-21.i.1 DORA (SaaS Security) DORA-9.2

severity: high Very Stale Pending Invite fix difficulty: easy #

Revoke invitations pending for more than 30 days as they represent a significant security risk

  1. Sign in to Sentry as an organization owner or admin
  2. Navigate to Settings > Members (https://sentry.io/organizations/<org>/settings/members/)
  3. Filter the member list to show pending invitations
  4. Identify invitations that have been pending for more than 30 days
  5. Click Revoke Invite for each stale invitation
  6. Contact the intended recipient and re-invite if access is still needed

Vendor docs ↗

Satisfies: NIS2 Directive NIS2-21.i.1 DORA (SaaS Security) DORA-9.2

More Sentry checks

The information on this page is provided for general informational purposes and is believed to be accurate as of its most recent update. Product names, logos, and trademarks are the property of their respective owners and are used for identification purposes only; their use does not imply any affiliation with or endorsement by those owners. Descriptions of third-party applications and of compliance frameworks are based on publicly available documentation and may change over time.

See these checks run on your stack

Start a free 14-day trial — no credit card required.

Start Free Trial