How do I know which users have more access than they need?

Compare each person's current permissions with the work they actually perform. Look for old administrator rights, access inherited from previous roles, shared accounts, and permissions left behind after job changes. Remove access that has no current business need.