Skip to main content
Early access. This feature is in early access, which means it’s undergoing ongoing testing and development while we gather feedback, validate functionality, and improve outputs. Contact the C1 Support team if you’d like to share feedback.
Use the By users scope type to review the access of the people you choose, rather than selecting the apps, entitlements, or resources they can access. When you stage the campaign, C1 finds the access those users hold at that moment and creates the reviews, so you don’t have to select every resource yourself.

When to use scope by users

Use By users when:
  • You’re reviewing everything a defined group of people can access—for example, a team, the direct reports of a manager, or all users with a given job title—and you don’t want to select every app and entitlement they might touch.
  • You’re reviewing a single user’s access, such as when someone changes roles or leaves. Pair a campaign template with an automation to start these reviews automatically.
  • You want the campaign to reflect each user’s access as it exists when you stage the campaign, including access that was granted after you set up the campaign or template.
If you’d rather scope by naming apps or entitlements, use the standard By entitlements scope type instead.

How C1 resolves the access to review

When you stage a campaign scoped by users, C1:
  1. Resolves your user selection. If you selected users by criteria or with a CEL expression, C1 includes the users who match at that time.
  2. Finds the current grants held by those users’ accounts across your apps.
  3. Removes any entitlements you excluded, and any accounts or grants that don’t match your account and grant selections.
  4. Creates reviews for the access that remains.
Users with no grants don’t produce any reviews. If your selection matches no users, the campaign is still staged, with no reviews.

Set up a campaign scoped by users

Follow these steps to create a single campaign scoped by users. You need the Campaign Administrator or Super Administrator user role.
1
Navigate to Governance > Campaigns and click New campaign.
2
Fill out the campaign details. Under Review scope type, select By users, then click Continue.
3
On the campaign’s Scope tab, find the User selection section and click Select users. Choose how to select the users, then click Save:
  • Select specific users. Build a list of up to 200 users.
  • Select users by criteria. Review users who match the criteria you set. You can combine these options:
  • CEL expression. Enter a CEL expression that describes the users you want to review. The expression must return a list of users to be valid.
A By users campaign requires a user selection. The Select all users option isn’t available.
4
Optional. Find the Excluded entitlements section and click Add exclusions. Click Entitlements to select individual entitlements, or Entitlements by type to select all the entitlements of a given type within an app, then click Save.If you don’t add exclusions, C1 reviews all the access the selected users have.
5
Optional. Find the Account selection section and click Narrow selection to review only the accounts that match your criteria. You can filter by account status, account type, or account domain, or enter a CEL expression. See Choose what to review for details.
6
Optional. Find the Grant selection section and click Narrow selection to review only the grants that match your criteria, such as new grants, temporary grants, or grants that haven’t been used recently. See Choose what to review for the available criteria.
7
Click Validate scope to preview the access that will be included in the campaign.
8
Follow the remaining campaign setup steps to stage and start the campaign.
When you stage the campaign, C1 creates reviews for the access the selected users hold. Reviewers work through the resolved access like any other campaign. To present reviews one person at a time, set Default access review view to By user on the campaign’s Configuration tab.
As with the rest of a campaign’s scope, you can’t change a campaign’s exclusions after you stage the campaign.

Use scope by users with templates and automations

The same scope configuration is available on campaign templates. When you create a template, select By users as the Review scope type, then configure the Scope tab as described above. Campaigns created from the template carry over its user selection, exclusions, account selection, and grant selection. C1 resolves the selection each time a campaign from the template is staged, so users who match your criteria at that time are included. Automations can start these reviews for you. When a Create campaign step uses a By users template, the user the step targets replaces the template’s user selection, so the campaign reviews that user’s current access. The template’s exclusions, account selection, and grant selection still apply.

Limitations of scope by users

A By users campaign:
  • Reviews grants held by users only. The Grant type options for reviewing grants held by groups or roles aren’t available.
  • Can’t be combined with resource selections or access conflicts. The Apps and entitlements section isn’t part of this scope type.
  • Can’t filter on accounts with no owner. The No account owner option isn’t available in Account selection.
  • Can’t select more than 200 specific users. To review a larger group, select users by criteria or with a CEL expression.