Skip to main content
A user access review (UAR) confirms that the access people already have is still appropriate — and revokes it when it isn’t. Auditors don’t just check that reviews happened; they check that every decision is evidenced, on time, for every system in scope — a missed campaign or an unresourced spreadsheet is a finding waiting to happen. Run manually, that’s a spreadsheet and a lot of chasing. In C1, it’s a campaign: a scoped, policy-driven review that routes each decision to the right person, gives them the context to decide quickly, and carries the outcome through to remediation and an audit record. This page walks that flow end to end. This is one piece of the broader identity governance picture — access reviews are how you verify that the access granted through onboarding, self-service requests, and provisioning is still correct.
This page assumes you’ve already added and configured connectors for the systems you want to review. If you’re setting up C1 for the first time, start with Get started with C1.

​
Scope the right reviews

Not every review needs to cover every permission. Building a campaign’s scope lets you review by application, by specific entitlements, by resource hierarchy (for cloud infrastructure), or by risk level and compliance framework — so a high-risk admin role and a low-risk read-only group don’t get reviewed on the same cadence or by the same process. You can narrow further by user criteria (department, manager, profile attributes) or by grant criteria (unused access, temporary grants, direct vs. inherited access). When the visual filters aren’t precise enough, user, account, and grant selection all accept a raw CEL expression instead — see CEL expression examples for real-world patterns. Reviews can also be scoped directly to risk: run a campaign against the users and entitlements flagged by an active conflict monitor to remediate separation-of-duties violations instead of reviewing everyone. Rather than configuring scope field by field, describe the review you need in plain language and let the Campaign assistant set up the policy, owners, and scope for you to review and adjust. For a review pattern you’ll run repeatedly, save it as a campaign template instead of rebuilding it each time.

​
Route every decision

Every review needs an owner. C1’s policies route each task to a manager, an app owner, an entitlement or resource owner, an account owner (self-review), a specific user, or a group — with a fallback reviewer if the primary reviewer can’t be identified. If someone shouldn’t receive tasks at all — an executive, someone on leave — set a delegate to redirect their reviews automatically.

​
Give reviewers context

A reviewer’s job is to decide, not to go hunting for the facts behind the decision. Each review task’s details drawer shows an Insights tab with how many other users hold the same access, its risk level, and related context, plus any attached resource attributes (like an AWS IAM policy) rendered as readable JSON instead of raw text.

​
Focus people on exceptions

C1 flags individual reviews with a recommendation — Take a closer look or Remove this access — so reviewers can act on exceptions instead of re-deciding routine access one row at a time. For faster batch work, the review assistant is an AI agent that acts on plain-language instructions (“approve all tasks with approve recommendations,” “deny access to the Admin entitlement”) and stages the changes for the reviewer to confirm before anything submits — people stay responsible for the decision, the agent just clears the routine work faster.

​
Complete remediation

A denial isn’t the end of the review — the access still has to come off. Revoking access denied during a campaign follows the same deprovisioning method configured on the entitlement, and can be automated as a follow-up step on the campaign’s review policy so revocation kicks off without a manual pass after the campaign ends. For apps that can’t be deprovisioned automatically, route the revocation to your ITSM as a ticket, and track whether that ticket resolved — campaign reports include ticket status as an optional column. For remediation that isn’t deprovisioning or a ticket — updating an external system of record, calling a custom endpoint — write it as a Function and run it as a follow-up step on the review policy.

​
Preserve audit evidence

Every campaign has a built-in report covering scope, reviewer, decision, and outcome, and you can verify a downloaded report’s file hash to prove it hasn’t been altered since it was generated. Every task also carries its own audit log and comment history, and the underlying identity and access events are available as system logs in OCSF format for export to a SIEM or long-term storage.

Create an access review campaign

Get started running access reviews

Manage an active campaign

Access conflicts (SoD)

Policies

Identity governance use case

JML automation use case

CEL expression examples

Extend with Functions