Access reviews

An access review — a certification campaign — asks the people who know: does this person still need this access? Personnel → Access reviews runs them, and keeps the answer.

A campaign in progress: entitlements pulled from the identity provider, reviewer decisions with timestamps, and third-party staff reviewed alongside employees.

Run a campaign

1. New campaign opens a three-step wizard: Details, Scope, Review.

2. Scope decides which systems, groups and people are in it. A campaign over everything at once is a campaign nobody finishes — pick the systems that matter and run more, smaller rounds.

3. Create draft, or Create & kickoff if you are ready to start.

4. Kickoff materialises the review items and puts them in reviewers’ queues. Until then, nothing is asked of anyone.

A campaign runs Draft → In progress → Closed, and can be frozen mid-flight if something needs sorting out before decisions continue.

Where the entitlements come from

Where an identity provider is connected, the entitlements are pulled from it — the actual group memberships, not a spreadsheet somebody exported last month.

For systems with no connector, use Upload entitlements: a CSV of who has what. The result tells you how many rows were imported out of how many parsed, which is worth reading rather than assuming.

Deciding

Reviewers work their own queue at Personnel → My access reviews. Each item takes a decision, and revoking or modifying asks for notes.

Items can be decided in bulk — select them and apply one decision to all — which is the right move for an obviously-fine batch and the wrong one for a whole campaign. Where the product suggests a decision, it shows why this was suggested; the suggestion is an input, not the answer.

A campaign that certifies everything certifies nothing

If a reviewer approves every row in four minutes, the campaign produced a timestamp and no assurance. Scope tighter, give reviewers the context they need to say no, and expect a real campaign to revoke something. Zero revokes across an entire estate is a finding about the review, not a clean bill of health.

Remediation is the half people forget

Deciding to revoke is not revoking. The Remediation tab lists every revoke-or-modify decision and tracks it to done — because the auditor’s question is not “did you review”, it is “and then what happened”.

Close the campaign when the decisions are made and the remediations are through. The closed campaign, with its decisions and timestamps, is the evidence: attach it to the control it proves, and its next run is already on your calendar via the tier or policy cadence that required it.