> ## Documentation Index
> Fetch the complete documentation index at: https://www.c1.ai/docs/llms.txt
> Use this file to discover all available pages before exploring further.

# Scope an access review campaign by users

> Use the By users scope type to review the current access of specific users, without selecting apps, entitlements, or resources.

> [!WARNING]
>
> **Early access.** This feature is in early access, which means it's undergoing ongoing testing and development while we gather feedback, validate functionality, and improve outputs. Contact the C1 Support team if you'd like to share feedback.

Use the **By users** scope type to review the access of the people you choose, rather than selecting the apps, entitlements, or resources they can access. When you stage the campaign, C1 finds the access those users hold at that moment and creates the reviews, so you don't have to select every resource yourself.

## When to use scope by users

Use **By users** when:

* You're reviewing everything a defined group of people can access—for example, a team, the direct reports of a manager, or all users with a given job title—and you don't want to select every app and entitlement they might touch.
* You're reviewing a single user's access, such as when someone changes roles or leaves. Pair a [campaign template](#use-scope-by-users-with-templates-and-automations) with an automation to start these reviews automatically.
* You want the campaign to reflect each user's access as it exists when you stage the campaign, including access that was granted after you set up the campaign or template.

If you'd rather scope by naming apps or entitlements, use the standard **By entitlements** scope type instead.

## How C1 resolves the access to review

When you stage a campaign scoped by users, C1:

1. Resolves your user selection. If you selected users by criteria or with a CEL expression, C1 includes the users who match at that time.
2. Finds the current grants held by those users' accounts across your apps.
3. Removes any entitlements you excluded, and any accounts or grants that don't match your account and grant selections.
4. Creates reviews for the access that remains.

Users with no grants don't produce any reviews. If your selection matches no users, the campaign is still staged, with no reviews.

## Set up a campaign scoped by users

Follow these steps to create a single campaign scoped by users. You need the **Campaign Administrator** or **Super Administrator** [user role](https://www.c1.ai/docs/product/admin/user-roles.md).

**Step 1**

Navigate to **Governance** > **Campaigns** and click **New campaign**.

**Step 2**

Fill out the campaign details. Under **Review scope type**, select **By users**, then click **Continue**.

**Step 3**

On the campaign's **Scope** tab, find the **User selection** section and click **Select users**. Choose how to select the users, then click **Save**:

* **Select specific users.** Build a list of up to 200 users.
* **Select users by criteria.** Review users who match the criteria you set. You can combine these options:
  * User status in C1
  * Direct reports of a manager
  * [User profile attributes](https://www.c1.ai/docs/product/admin/attributes.md)
  * Exclude users in specific groups
* **CEL expression.** Enter a [CEL expression](https://www.c1.ai/docs/product/admin/expressions.md) that describes the users you want to review. The expression must return a list of users to be valid.

A **By users** campaign requires a user selection. The **Select all users** option isn't available.

**Step 4**

**Optional.** Find the **Excluded entitlements** section and click **Add exclusions**. Click **Entitlements** to select individual entitlements, or **Entitlements by type** to select all the entitlements of a given type within an app, then click **Save**.

If you don't add exclusions, C1 reviews all the access the selected users have.

**Step 5**

**Optional.** Find the **Account selection** section and click **Narrow selection** to review only the accounts that match your criteria. You can filter by account status, account type, or account domain, or enter a CEL expression. See [Choose what to review](https://www.c1.ai/docs/product/admin/campaigns.md#step-3-choose-what-to-review) for details.

**Step 6**

**Optional.** Find the **Grant selection** section and click **Narrow selection** to review only the grants that match your criteria, such as new grants, temporary grants, or grants that haven't been used recently. See [Choose what to review](https://www.c1.ai/docs/product/admin/campaigns.md#step-3-choose-what-to-review) for the available criteria.

**Step 7**

Click **Validate scope** to preview the access that will be included in the campaign.

**Step 8**

Follow the remaining campaign setup steps to stage and start the campaign.

When you stage the campaign, C1 creates reviews for the access the selected users hold. Reviewers work through the resolved access like any other campaign. To present reviews one person at a time, set **Default access review view** to **By user** on the campaign's **Configuration** tab.

> [!NOTE]
>
> As with the rest of a campaign's scope, you can't change a campaign's exclusions after you stage the campaign.

## Use scope by users with templates and automations

The same scope configuration is available on **campaign templates**. When you create a template, select **By users** as the **Review scope type**, then configure the **Scope** tab as described above. Campaigns created from the template carry over its user selection, exclusions, account selection, and grant selection. C1 resolves the selection each time a campaign from the template is staged, so users who match your criteria at that time are included.

Automations can start these reviews for you. When a [**Create campaign**](https://www.c1.ai/docs/product/admin/automations-steps-reference.md#create-campaign) step uses a **By users** template, the user the step targets replaces the template's user selection, so the campaign reviews that user's current access. The template's exclusions, account selection, and grant selection still apply.

## Limitations of scope by users

A **By users** campaign:

* Reviews grants held by users only. The **Grant type** options for reviewing grants held by groups or roles aren't available.
* Can't be combined with resource selections or access conflicts. The **Apps and entitlements** section isn't part of this scope type.
* Can't filter on accounts with no owner. The **No account owner** option isn't available in **Account selection**.
* Can't select more than 200 specific users. To review a larger group, select users by criteria or with a CEL expression.