Access matrix vs. RBAC: what fits your growth stage?

A direct matrix (person × system) works up to around 30 employees. After that, you go role-based. Here's when to make the switch — and how to do it without a big bang.

An access matrix is your starting point. RBAC is where you end up. So when do you make the move?

Signs your matrix is bursting at the seams

• You have > 25 employees — and every spreadsheet update takes 20 minutes.
• New hires always get the same set of permissions — you're copy-pasting by role.
• During a review, 80% of your decisions are "keep, same as everyone else in Sales".
• A compliance audit is coming up and you want to be able to show clear patterns.

If 2 or more of these apply: it's time to go role-based.

How do you switch without disruption?

1. Keep the existing matrix active. You're not throwing it away.
2. Define your roles based on what you already see in the matrix — not on how things should theoretically work.
3. Assign people to roles. Any gap between what the role defines and what they currently have is an exception — document it explicitly.
4. New hires → onboard via role. Existing staff → align through the review cycle (not all at once — spread it over 2 quarters).

What if you use M365?

Then your roles already have a natural home: security groups in Entra ID. See M365 governance for how to link groups ↔ AccessProfiles via directory sync. That's the ideal combination: placing people in Entra groups automatically applies the right access.

The matrix stays your validation layer

Even after adopting RBAC, you keep the matrix. Roles represent intended access; the matrix shows actual access. During a review, you compare the two — any differences are exactly where investigation is needed.