> For the complete documentation index, see [llms.txt](https://docs.securepass.me/llms.txt). Markdown versions of documentation pages are available by appending `.md` to page URLs; this page is available as [Markdown](https://docs.securepass.me/documentation/admin-user-guide/governance-and-reporting/access-review.md).

# Access review

An access review asks the people who should know — a manager, an application owner — to confirm that the access their users hold is still correct. What they approve stays; what they reject is flagged for removal.

This guide covers creating a review as an administrator, and completing one as a reviewer.

## The Access Review page

Open **Access Management → Access Review**.

![](https://content.gitbook.com/content/W2srIAMN6RKFwvuEorV5/blobs/YDxP9dJM0KPaFAJC6c4x/assets/01.png)

| Column                   | Shows                                                                                       |
| ------------------------ | ------------------------------------------------------------------------------------------- |
| Access Review Name       | The campaign name                                                                           |
| Review Entity            | What is being reviewed, as scope → filter — for example *All Users → Specific Applications* |
| Start Date / End Date    | The review window                                                                           |
| Created By / Modified By | Who set it up and who last changed it                                                       |
| Status                   | **In Progress**, **Completed**, or **Expired**                                              |
| Actions                  | View · Review outcomes · Edit · Delete                                                      |

{% hint style="info" %}
**Expired** means the end date passed with items still unreviewed. Those items are neither approved nor rejected — nobody decided. Watch for this status; an expired campaign leaves access exactly as it was.
{% endhint %}

## Creating an access review

Select **Create Access Review**. The wizard has three steps.

{% stepper %}
{% step %}

## Access review details

![](https://content.gitbook.com/content/W2srIAMN6RKFwvuEorV5/blobs/fHYcLhdktVyy1d53aPui/assets/02.png)

| Field              | What to enter                                        |
| ------------------ | ---------------------------------------------------- |
| Access Review Name | Required. How the campaign is identified in the list |
| Description        | Optional                                             |
| Start Date & Time  | Required. When the review opens                      |
| End Date & Time    | Required. The deadline for reviewers                 |

Select **Next**.
{% endstep %}

{% step %}

## Access profiles

This is where you define what gets reviewed. **Scope** sets the population; **Filter By** narrows it to particular resources.

![](https://content.gitbook.com/content/W2srIAMN6RKFwvuEorV5/blobs/TdwKzlpAvvIXJyDjMzeJ/assets/03.png)

Scope offers **All Users · Specific Users · All Groups · Specific Groups · All Applications · Specific Applications**.

Choosing a *Specific* option adds a second field for picking the exact users, groups or applications.

![](https://content.gitbook.com/content/W2srIAMN6RKFwvuEorV5/blobs/ky7Orq3VmFaZmjAzLRSg/assets/04.png)

The blue banner confirms what you have built — *Reviewing: Specific Groups → Specific Applications* — with a count beside each selector. Read that banner before continuing; it is the clearest statement of what the campaign will actually cover.

Select **Next**.
{% endstep %}

{% step %}

## Assign approvers

Three ways to decide who reviews.

![](https://content.gitbook.com/content/W2srIAMN6RKFwvuEorV5/blobs/HOymcPxKPJ9OblJlunEU/assets/05.png)

| Option                     | Who reviews                                                          |
| -------------------------- | -------------------------------------------------------------------- |
| **Access Profile Creator** | Whoever created the access being reviewed. The list of them is shown |
| **Reporting Manager**      | Each user's own manager                                              |
| **Select Manually**        | Named approvers you choose                                           |

![](https://content.gitbook.com/content/W2srIAMN6RKFwvuEorV5/blobs/4Wmd0DGIzxGtFPx2kne8/assets/06.png)

**Select Manually** gives a picker, with **Add New Approver** to name more than one.

**Add another level** creates a second approval level, so an item passes to the next reviewer after the first has acted.

Select **Create Access Review**. The campaign appears in the list.
{% endstep %}
{% endstepper %}

## Managing a review

Four actions sit on each row.

### View

Opens the campaign read-only, across three tabs — details, access profiles and approvers. The **Approver Order Diagram** shows the chain from originator to approver, colour-coded by state.

![](https://content.gitbook.com/content/W2srIAMN6RKFwvuEorV5/blobs/1aY9mAL1FrowWKIhxNaZ/assets/07.png)

The legend is worth knowing: **Completed · Pending · Not Started · Rejected · Expired · Delegated**.

### Review outcomes

Shows every item in the campaign and where it has got to — each user with their application on the left, the approver in the middle, and the current state on the right.

![](https://content.gitbook.com/content/W2srIAMN6RKFwvuEorV5/blobs/fnEGcnR9JXz68Vd2tzJU/assets/08.png)

### Edit

Reopens the wizard so the dates, scope or approvers can be changed.

### Delete

Removes the campaign.

![](https://content.gitbook.com/content/W2srIAMN6RKFwvuEorV5/blobs/keTnkuD0uHdILFFETsrt/assets/09.png)

{% hint style="warning" %}
Deleting a campaign cannot be undone, and any decisions already recorded against it go with it.
{% endhint %}

## The reviewer's side

### The invitation

Each assigned reviewer is emailed when the campaign opens.

![](https://content.gitbook.com/content/W2srIAMN6RKFwvuEorV5/blobs/OvY2fJd5r08akEcPlKQD/assets/10.png)

The email names the campaign, their role and the due date, and carries a **Start your review** button.

### Finding the review

The button opens the Self Service Portal. Reviewers can also reach it directly: **Access Review** in the portal navigation.

![](https://content.gitbook.com/content/W2srIAMN6RKFwvuEorV5/blobs/t61wvGa3GbrUzvsGMzK0/assets/11.png)

Four tabs sort the work: **Pending · Approved · Rejected · Expired**. **Export** downloads the list.

### Opening or delegating

The three-dot menu on a row offers **View Access Review** and **Delegate**.

![](https://content.gitbook.com/content/W2srIAMN6RKFwvuEorV5/blobs/VToJI7kocxS3rtv1db2I/assets/12.png)

Delegating passes the review to someone else — useful when the assigned reviewer is not the right person to judge, or is away before the deadline.

### Reviewing the items

**View Access Review** opens the campaign across three tabs: **Campaign Details**, **Access Profiles** and **Approvers**.

**Access Profiles** is where the work happens. Each row is a user, the roles they hold, and the application they hold them on.

![](https://content.gitbook.com/content/W2srIAMN6RKFwvuEorV5/blobs/txzwhuiftmyrINYkaeAW/assets/13.png)

Act on rows one at a time with the green tick and red cross, or tick the checkboxes and use **Bulk Approve** or **Bulk Reject**.

Either way a reason is asked for.

![](https://content.gitbook.com/content/W2srIAMN6RKFwvuEorV5/blobs/YvnPsnHavDtm3jhoFwyp/assets/14.png)

Enter the reason and select **Approve**.

{% hint style="info" %}
The reason is not a formality. It is what an auditor reads when they ask why a particular entitlement was kept — and it is the only record of the reviewer's thinking.
{% endhint %}

### After the decision

Reviewed items move to the **Approved** or **Rejected** tab.

![](https://content.gitbook.com/content/W2srIAMN6RKFwvuEorV5/blobs/lYtFfLTIHu3lGkB1fdLQ/assets/15.png)

## Checking the result as an administrator

Back in the admin console, open **Review outcomes** on the campaign row. The diagram now shows the decisions.

![](https://content.gitbook.com/content/W2srIAMN6RKFwvuEorV5/blobs/9ZWTfbTJERnrIJ4oZPRK/assets/16.png)

When every item has been acted on, the campaign's status becomes **Completed**.

A review is only worth running if someone finishes it. The two things to watch are the **Expired** status, which means the deadline passed with items undecided, and the reasons recorded against approvals — those are what the campaign is actually for.