Category: Governance & Compliance

Recertification Campaign

Also known as: Access Certification Campaign, Certification Campaign, Access Recertification Campaign

Simply put

A recertification campaign is an organized review in which the right people periodically confirm whether users still need the access they currently have. Managers or resource owners look at each person's permissions and decide to keep or remove them, and those decisions are tracked until the review is complete. It is a governance activity used to keep access rights accurate over time, not a real-time control that grants or blocks access as it happens.

Formal definition

A recertification campaign is a time-bound, structured access review process within identity governance and administration (IGA) in which designated reviewers (typically managers or resource owners) attest whether an identity should retain its assigned access rights and permissions. Campaigns are typically driven by a recertification rule defining the reviewer, scope, and cadence, and may cover a broad set of identities or a defined set of critical resources; per the evidence, the scope can include both users and non-human/AI-agent identities depending on the platform. Each review yields keep or revoke decisions that are tracked through completion, with revocations feeding downstream remediation such as deprovisioning. This is an IGA lifecycle and attestation concern focused on periodic validation of standing access, and it is distinct from runtime enforcement mechanisms (for example PDP/PEP evaluation or token validation) that make access decisions at the moment of a request. Specific workflow behavior, remediation automation, and supported identity types vary by vendor and deployment configuration.

Why it matters

Access rights tend to accumulate over time as people change roles, join projects, or take on temporary responsibilities that are never fully unwound. Without a periodic mechanism to validate standing access, organizations drift toward over-entitlement, where identities retain permissions they no longer need. Recertification campaigns provide the structured, time-bound mechanism to catch and correct this drift by requiring the right reviewers to explicitly confirm whether each identity should keep its access.

Because these campaigns produce documented keep-or-revoke decisions tracked through completion, they also serve as evidence for compliance and audit purposes. Regulators and auditors frequently expect organizations to demonstrate that access to sensitive systems is reviewed on a defined cadence and that inappropriate access is remediated. A well-run campaign creates that audit trail and supports enforcement of governance objectives such as least privilege and segregation of duties, though the campaign itself does not enforce access in real time.

It is important to keep the scope of recertification realistic. A campaign validates standing access as of the review; it is a periodic governance activity, not a runtime control. Access granted or changed between campaign cycles is only caught at the next review unless other controls apply. The value of a campaign therefore depends heavily on cadence, reviewer diligence, and the reliability of downstream remediation, all of which vary by deployment.

Who it's relevant to

Identity Governance Leads

Governance leads own the design and cadence of recertification campaigns, including the recertification rules that define reviewers, scope, and frequency. They balance thoroughness against reviewer workload and are accountable for ensuring campaigns close on time with actionable decisions rather than rubber-stamped approvals.

Compliance and Audit Officers

Recertification campaigns generate the documented review decisions and completion records that auditors and regulators often expect as evidence of periodic access validation. Compliance officers rely on these campaigns to demonstrate that access to sensitive resources is reviewed and remediated on a defined cadence.

Managers and Resource Owners

As the designated reviewers in most campaigns, managers and resource owners make the keep-or-revoke attestations for each identity's access. Their diligence directly determines campaign quality, since the process validates whether an identity still needs its permissions rather than automatically enforcing access.

IAM Engineers and Administrators

IAM engineers configure the campaign workflows, integrate the identity sources under review, and wire revocation decisions into downstream remediation such as deprovisioning. They also account for the range of identity types in scope, which may include non-human or AI-agent identities depending on the platform.

Inside Recertification Campaign

Campaign Scope

The defined set of identities, entitlements, roles, or accounts targeted for review in a given cycle. Scope is typically bounded by criteria such as application, business unit, risk level, or entitlement type, and determines which access assignments will be presented to reviewers.

Reviewers (Certifiers)

The principals responsible for attesting to the appropriateness of access. Depending on configuration, these are commonly line managers, application or resource owners, or role owners. Reviewer assignment logic is a core component and affects both accuracy and completeness of the campaign.

Review Items (Line Items)

The individual access assignments presented for decision, typically pairing a subject (user or non-human identity) with an entitlement, role membership, group, or account. Each item carries a decision outcome such as approve/certify, revoke, or reassign.

Decision Actions and Outcomes

The set of actions a reviewer can take on each item, typically certify (attest access is appropriate) or revoke (flag for removal). This is an IGA certification concern; the resulting revocation must be fulfilled through a downstream provisioning or deprovisioning action rather than by real-time enforcement at the point of the campaign.

Segregation of Duties (SoD) Context

Supplemental data indicating whether a given assignment contributes to a toxic combination or policy violation, so reviewers can factor SoD conflicts into their decisions. This is part of governance analysis rather than runtime policy enforcement by a PDP/PEP.

Schedule and Cadence

The timing configuration of the campaign, such as periodic (for example quarterly or annual) or event-driven triggers. Cadence is typically driven by risk tier, regulatory requirement, or internal policy and varies by deployment.

Escalation and Delegation

Mechanisms for handling reviewer inaction or unavailability, including delegating items to an alternate reviewer or escalating overdue items to a supervisor. Behavior here depends heavily on vendor and configuration.

Audit Trail and Evidence

The recorded log of who reviewed what, the decision made, the timestamp, and any comments. This evidence supports compliance attestation and internal or external audit, and is a defining output of a certification campaign.

Remediation Tracking

The workflow that carries a revoke decision through to actual removal of access and confirms completion. Tracking closure is distinct from the certification decision itself and is where governance intent meets administrative fulfillment.

Common questions

Answers to the questions practitioners most commonly ask about Recertification Campaign.

Does running a recertification campaign enforce access at runtime, so revoked entitlements are immediately blocked?

No. A recertification campaign is an identity governance and administration (IGA) activity focused on periodically reviewing and certifying whether existing access is still appropriate. It is distinct from runtime access enforcement performed by a PDP/PEP evaluating a request. When a reviewer revokes an entitlement during a campaign, that decision typically triggers a downstream deprovisioning or remediation workflow; the timing and reliability of the actual access removal depend on the connected provisioning integration and configuration, not on the certification decision itself. Until remediation completes, the principal may retain effective access.

Is a recertification campaign just a way to assign or define roles?

No. A recertification campaign reviews and attests to access that already exists; it is not a role design or role assignment mechanism. Role definition, entitlement modeling, and initial provisioning are separate lifecycle activities. A campaign can surface problems such as accumulated access or apparent segregation-of-duties conflicts for reviewers to act on, but the underlying access model (for example RBAC roles or ABAC attributes) is defined and administered elsewhere. The campaign is an attestation and validation step, not the source of the assignments being reviewed.

How do you scope a recertification campaign so reviewers are not overwhelmed?

Scope is typically defined by the population of principals, the set of applications or entitlements, and the review criteria. Common approaches narrow the campaign to a specific business unit, a set of high-risk or privileged entitlements, or access that has changed since the last review. Many deployments segment large populations into multiple targeted campaigns rather than a single broad one to reduce reviewer fatigue, though the available scoping dimensions depend on the IGA platform and how entitlement data is modeled.

Who should be assigned as the reviewer in a recertification campaign?

The appropriate reviewer depends on the campaign objective. Manager-based reviews route each user's access to their line manager, while application-owner or entitlement-owner reviews route access to the party accountable for a resource; some programs use both in layered passes. Assigning reviewers who lack context to make an informed decision tends to produce rubber-stamping, so reviewer selection should align with who can actually judge whether the access is appropriate. Exact reviewer routing logic varies by tool and configuration.

How should segregation-of-duties considerations be handled within a recertification campaign?

Recertification is one place where potential segregation-of-duties (SoD) conflicts can be surfaced to reviewers, for example by flagging combinations of entitlements that violate a defined policy so the reviewer can revoke or justify them. However, SoD policy definition and continuous conflict detection are generally maintained as separate IGA functions; the campaign consumes those policy results rather than defining them. Whether conflicts are shown inline during review depends on how the platform integrates SoD analysis with the certification workflow.

What happens to entitlements that a reviewer does not act on before a campaign closes?

The handling of un-actioned items depends on the campaign's configured default and escalation behavior. Some deployments auto-revoke access that is not explicitly certified, others auto-certify (retain) it, and others escalate the item to another reviewer or leave it pending; each choice carries different risk and audit implications. Because a no-decision default of auto-certify can silently retain inappropriate access, many programs pair defaults with escalation and reminder workflows. The exact options available are configuration- and vendor-dependent.

Common misconceptions

A recertification campaign enforces access changes in real time when a reviewer clicks revoke.

A campaign is an IGA governance and certification exercise, not a runtime enforcement mechanism. A revoke decision typically generates a downstream provisioning or deprovisioning task; the actual removal of access depends on fulfillment workflows and connected systems, and there is often a lag between decision and effective revocation. This is separate from runtime enforcement handled by a PDP/PEP at access time.

Recertification verifies who users are, so it is a form of authentication.

Recertification reviews what access a principal holds and whether it remains appropriate, which is an authorization and governance concern. It does not verify a user's identity in the sense of authentication; identification, authentication, and authorization are distinct steps, and a campaign operates over already-established authorization assignments.

Certifying every item as approved satisfies the control regardless of reviewer diligence.

Bulk or rubber-stamp approval undermines the purpose of the campaign even though it produces a complete audit trail. The value of the control depends on informed, item-level decisions supported by adequate context; a fully certified campaign with no genuine review provides weak assurance and can conceal excessive or conflicting access.

Best practices

Scope campaigns by risk so that high-privilege, sensitive-application, and SoD-relevant access is reviewed more frequently than low-risk access, rather than applying a single uniform cadence to everything.

Assign reviewers who have direct knowledge of the access under review, typically resource or application owners for entitlement-level decisions and managers for user-level appropriateness, and make the reviewer selection logic explicit and auditable.

Provide reviewers with sufficient context for each item, including entitlement descriptions, last-used or activity data where available, and any SoD conflict indicators, to reduce rubber-stamping and improve decision quality.

Track revoke decisions through to fulfillment and confirm closure, treating the certification decision and the downstream deprovisioning action as separate steps that both require verification.

Configure escalation and delegation paths for overdue or unattended items so that reviewer inaction does not silently leave access uncertified.

Retain a complete audit trail of reviewers, decisions, timestamps, and comments to support compliance attestation, and periodically review campaign metrics such as revocation rates and completion times to detect low-diligence reviewing.