Having one tab on PAAS portal for Azure Access Users. Only technical contact (TC will be able to see this tab, which having a list of current users who is having access to the customer's resource group because TC will be aware to correct the list, remove/update those who is not working on that project anymore. This is to prevent possible security risk for their environments.
In the case, the technical contact becomes invalid, he/she can submit a button "Request to change technical contact information" on this tab. And a new form will be popped up for him/her to fill in the "Change Request", once the form is submitted, it will create a ticket to support team for further handling.
Note: technical contact is the person who is eligible to provide approval for a user who request to get access to Azure/PAAS portal.