Administer an active campaign

Campaign Owners have several tools at their disposal to help guide an access review campaign through the process of gathering reviews.

View campaign progress

On the Overview tab of any running campaign, view a dashboard of the campaign’s progress and metrics.

On this dashboard, you can:

• Get a summary of the campaign’s progress and open tasks
• Track reviewer approval rates and average review time
• Remind reviewers to complete their open tasks
• Track review completion status by application
• View a burndown chart of the campaign’s remaining open reviews over time

View and manage individual reviews

On the campaign’s Tasks tab, you can filter the list of campaign tasks, open individual access reviews’ details panes, and take action:

• Complete any tasks assigned to you
• See the status of the access review (completed, open)
• See the outcome of the access review (approved, denied)
• Reassign the review, if necessary
• Restart the review, if necessary
• Send the assigned reviewer a reminder notification
• Add comments
• View audit log history
• View related tasks

Use the Outcome filter to narrow the task list to a specific result: granted, denied, revoked, certified, error, canceled, or timed out.

You can also generate a CSV report of all tasks in the campaign by clicking the Generate CSV icon at the top of the Tasks table. Your report will be prepared and posted in the downloads center at the top of the page when ready.

View review submissions

On the Submissions tab, you’ll find a log of review submissions by the reviewers assigned to complete tasks in your campaign. Each line in the submission log includes the submission date (hover over the date for an exact timestamp), and the count of submitted reviews, broken down by certifications and denials.

What’s the difference between the submitted reviews and successfully submitted columns? Occasionally there can be a discrepancy between the reviews submitted by a reviewer and the official record of the reviews submitted to the campaign. Reasons for this kind of discrepancy include errors in review processing, or situations such as when multiple reviewers are assigned to the same review and another reviewer submits a decision first.

Click the Generate CSV icon above the log to generate a downloadable report of all submission data.

Send notifications

C1 automates the process of notifying users about their open access reviews, reassignments, and impending deadlines.

Make sure that notification emails reach you:

Add [e-mail] to your email contacts list.

Automatic notifications

If the Campaign Owner has enabled campaign notifications, these notifications are sent automatically:

Notification	Time sent	Notes
Campaign kickoff	When the campaign starts	Sent to all users who have access reviews assigned to them for the campaign. Only sent if the Campaign Owner opts into sending this notification when starting the campaign.
Reminder of your open access reviews	Weekly until three days before the campaign due date Three days before the campaign due date One day before the campaign due date On the campaign due date Daily every day past the campaign due date	Sent to all users who have uncompleted access reviews in the campaign.
Access review assignment	When a task is reassigned to a new user.	Sent to the user who is now assigned to the access review.
Campaign close	When the campaign ends	Sent to all users who were assigned access reviews for the campaign.

On-demand notifications

To help remind users to complete their campaign access reviews, a Campaign Owner can also send the following notifications on demand at any time during the campaign:

Notification	Sent to	Notes
Complete your access reviews reminder	All users currently who have uncompleted access reviews in the campaign.	A campaign-wide reminder. Triggered by clicking Send reminders on the main campaign page.
Complete this access review reminder	The user currently assigned to a specific uncompleted access review.	A reminder sent to one individual about one task. Triggered by clicking … > Send reminder in the task details view.

Manually end a campaign

Campaigns continue running past their scheduled end date unless configured to end automatically. A Campaign Owner or Super Administrator must manually end campaigns that aren’t set to auto-end.

Click End campaign to finish and close an active campaign. Here’s what happens next:

• If any reviews are outstanding, ending the campaign cancels those requests.

• When ending the campaign, you’ll be asked if remaining open reviews should be Skipped or Revoked.

• The completed campaign is automatically archived on the Completed tab on the Campaigns page.

Depending on the size of the campaign, ending it might take some time. You’ll see a notification popup alerting you when the campaign ending process begins, and another when it’s complete.

Once a campaign is complete, the configuration and access reviews for the campaign cannot be changed. However, you can still view and generate reports for the campaign.

Revoke access that was denied during the campaign

Once the campaign ends, you can manually start the process of revoking access to the entitlements that were denied during the campaign.

1. Navigate to the campaign’s details page.

2. On the Access reviews tab, use the Status filter to show only tasks with a Denied status.

3. If access has already been revoked, an Access revoked message is shown in the task’s Outcome column. If this column is blank for a task, you can revoke the access manually.

4. Click the … (more actions) menu for the task and select Revoke access. A revocation task is created.

Depending on the revocation policy set on the entitlement, the task might require review and approval before the access is removed by either an automatic or manual process. C1 will create and assign the tasks as appropriate.

Add a revocation step to your campaign’s review policy to automate this process.

To automatically kick off a revocation flow for any access denied during the campaign, add a post-execution step to the review policy used on the campaign. See Add followup tasks to learn more.

Generate a campaign report

Access review campaigns have built-in reports that show the progress and prove the outcomes of the campaign. Reports can be generated at any time after a campaign has started. Campaigns and campaign templates can also be configured to auto-generate a campaign report when the campaign ends.

To generate a report:

1. Navigate to Governance > Campaigns.

2. On the Running or Completed tab, locate and click the name of the campaign you’re interested in.

3. Click Reports > Generate report. Choose which columns to include in the report:

   • Default columns: the standard column set.
   • Custom columns: the default columns plus any combination of Employee ID, Job title, Department, Employment status, Employment type, Manager, External ticket, and External ticket status. The external ticket columns only appear if external ticketing is configured for your tenant.

   Confirm your selection to generate the report.

4. The report is compiled for you. Depending on the size of the campaign, this might take several minutes, so please be patient.

5. When the report is ready, click Download to receive the report in Excel format.

Verify report hashes

If you need to verify the checksum of a downloaded report for auditing purposes, here’s what to do:

1. Navigate to Governance > Campaigns.

2. Click the name of the campaign you’re interested in.

3. Click Reports. You’ll see the file hashes for each report you’ve generated.

4. If necessary, download the report.

5. On the command line, navigate to the directory where the downloaded report file is stored. Run the commands appropriate to your operating system, subbing in the name of the downloaded report for <FILENAME>.

   Windows

    CertUtil -hashfile <FILENAME> MD5
    CertUtil -hashfile <FILENAME> SHA256
   

   Linux

   md5sum <FILENAME> 
   sha256sum <FILENAME>
   

   MacOS

   md5 <FILENAME> 
   shasum -a 256 <FILENAME>
   
6. Compare the output of the commands with the file hashes printed on the Reports page. The checksums will match if the downloaded file has not been altered.

Frequently asked questions about campaigns

If an access review campaign due date has passed, can a reviewer still complete their assigned tasks?

You can complete tasks until the campaign ends, either automatically or by a Campaign Owner or Super Admin.

• For reviewers: If a task is no longer available on the Reviews page, the campaign has ended and no action can be taken. The task can be viewed and comments added under Completed tasks.

• For campaign administrators: When it’s time to end a campaign (or when configuring an automatic campaign end), you will chose what action to take for any uncompleted tasks.

Can a reviewer reopen a task they've completed?

Once a review task is completed, a campaign manager or Super Admin can restart the task if needed.

To restart a task:

1. Navigate to Governance > Campaigns.

2. Click the name of the campaign, then click Tasks.

3. Locate the task that should be reopened.

4. In the more actions (…) menu, select Restart.

Once a task is restarted, the task will be ready for review again on the reviewer’s Reviews page.

Can we delete or remove a task from an in-progress campaign?

Yes, a campaign manager or Super Admin can remove a task from a campaign.

1. Navigate to Governance > Campaigns.

2. Click the name of the campaign, then click Tasks.

3. Locate the task that should be removed.

4. In the more actions (…) menu, select Delete.

If a task is not automatically assigned to a reviewer and we don't have a fallback user defined in the policy, what happens to the task?

The task is automatically reassigned to the campaign owners.

If someone leaves the company after the campaign has begun, what happens to review tasks about their access?

If the user who is the subject of an access review task is marked deleted in the system after the campaign has started but before the task has been completed, that task is automatically canceled.