On this page0
Guide
Run an access review
Have each manager confirm, person by person, that the access their team holds is still right, revoke what isn't, and hand an auditor the record.
Before you start
- To launch and close campaigns you need a role with the permission to create and administer access-certification campaigns. Administrators have it.
- A reviewer needs no special permission to decide the items assigned to them. The link in the email opens their queue, and they can keep or revoke their own items there.
- Access GovernanceAccess Reviews appears in the menu only for a person whose role holds an access-review permission. Administrators have one, and so do members of the built-in “Manager” group, through its role “manager_approver”. A reviewer without one reaches the queue from the email link.
- Being someone’s manager on the org chart does not put a person in the “Manager” group. To give a reviewer the menu entry, add them to it in AdministrationGroups. Its members can also approve access requests for anyone in the organisation, so add people deliberately.
- Set each person’s manager in their profile. Items are routed to the manager.
- Optional: to review app access that is really in use, and to catch drift, connect apps in SaaS Discovery (included from the Team plan).
Launch a campaign
Step 1: Open Access Reviews
Go to Access GovernanceAccess Reviews. The page has three tabs: “Reviews”, “Current access & drift” and “Schedules”. Click “New campaign”.
Step 2: Fill in the campaign
Enter a “Campaign name”. For “Scope”, choose “All active employees” or “A department” and pick the “Department”. Set a “Due date (optional)”.
Under “External app access”, choose what app access to include besides Zonitix roles and groups:
- “Don’t review external apps”: Zonitix roles and groups only.
- “Blueprint — what the role should grant”: the apps each person’s role is set up to give them.
- “Actual usage — what’s really in the connected apps”: what SaaS Discovery finds.
- “Both — flag drift (used but not in the role)”: both lists, with anything in use but not from the role flagged as “Drift”.
Step 3: Launch it
Click “Launch”. Zonitix takes a snapshot of everyone’s access in scope. Each item goes to that person’s manager. If someone has no manager on file, their items go to you, the campaign creator. If the manager’s account is not active, the items go to that manager’s own manager, then to you, then to a person whose role can administer access reviews. Each reviewer gets one email with their item count and the due date, if email is set up.
You do not pick reviewers by hand here. To move items to someone else, use the reassign button on a row, or tick several and reassign them together.
Reviewers decide
Step 4: Open the queue
A reviewer opens Access GovernanceAccess Reviews and selects “My review queue” on the left. Items are grouped by person, riskiest first. Filter with “All”, “Needs attention” (privileged or drift) or “Expected”. Click a row to see what the access grants and what the person loses if it is revoked.
Step 5: Certify or revoke
Click “Certify” to confirm the access is still needed, or “Revoke” to remove it. “Certify N expected” on a person’s row certifies all their routine items at once and leaves privileged and drift items for you to judge. You can also tick items and use the bulk bar.
Nobody can certify their own access, administrators included. Your own items show “Your access” and have no buttons. An access-reviews admin must reassign them to someone else.
Step 6: Know what a revoke does
The confirm dialog tells you which kind it is:
- A Zonitix role or group is removed right away.
- An external app is not removed on the spot. Zonitix raises an IT deprovision run, titled “Access revoke: …”, in ExecutionWorkflow Tasks. Its first step is “IT Deprovision Approval”. Once IT approves, connected apps are removed automatically and anything else becomes an IT task.
Members of the IT group and administrators can approve or reject the “IT Deprovision Approval” step. Anyone else sees it as “Read-only — currently with another team.” Until IT approves it the access is not removed, and the export shows the revoke as pending IT.Every decision is written to the audit log.
Close and export
Step 7: Close the campaign
A campaign completes by itself when every item is decided. To end it early, select it on the left and click “Close”. Undecided items stay undecided, and the close is recorded as early.
A campaign you launch by hand is not closed or chased on its due date. For that, use a schedule (below).
Step 8: Export the evidence
Select the campaign and click “Export CSV” (or “Export evidence” at the top). The file lists each person, access, decision, who decided and when, the reviewer, any note, and an “Applied” column that says whether each revoke was actually carried out or is still pending IT.
Keep old campaigns with “Archive”. “Delete” is offered only while nothing in the campaign has been decided.
Schedule a recurring review
Step 9: Create the schedule
On the “Schedules” tab, click “New schedule”. Enter a “Schedule name”, then choose the “Scope” and “External app access” as for a campaign (external app access starts on “Both — flag drift”).
Pick a “Cadence”: “Monthly”, “Quarterly” (the default), “Semi-annual”, “Annual”, or “Every N months” with your own number. Set “First run”, or leave it blank to start now. “Reviewers get (days)” is how long each campaign stays open before its due date; it starts at 14.
Step 10: Choose what happens at the due date
Three switches sit at the bottom of the dialog:
- “Remind reviewers” (on by default): reviewers with undecided items are emailed once a day from two days before the due date.
- “Auto-close at due date” (on by default): the campaign is closed on its due date, with undecided items left undecided.
- “Skip if previous still open” (off by default): a new campaign is not launched while the last one from this schedule is still open.
Click “Create”. Each campaign the schedule launches is named after the schedule and the quarter.
Step 11: Pause it, or run it now
Each schedule row has “Run now”, “Pause” (or “Resume”), “Edit” and a delete button. Deleting a schedule keeps its past campaigns. Creating and changing schedules needs the same permission as launching a campaign.
What you should see
On the left, the campaign shows its progress. Once every item is decided, its status reads completed. The exported CSV is the record to hand to your auditor.
If something goes wrong
- A manager says they got the email but cannot find Access Reviews.
- Access Reviews is in the menu only for a role that holds an access-review permission. They can open the link in the email to reach their queue and decide their items. To give them the menu entry, add them to the Manager group in Administration, Groups, or add that permission to a role they hold.
- "You cannot certify your own access (separation of duties)."
- The item is your own access, often because you have no manager on file and it fell back to you. An access-reviews admin must reassign it to another reviewer.
- "The primary administrator’s access is protected and cannot be revoked."
- By design, the primary administrator’s Zonitix roles and groups cannot be revoked from a review. Certify the item instead.
- The Applied column shows "NOT applied" for a revoke.
- The removal failed, or the deprovision run could not be raised, or the person no longer exists. Remove the access by hand. If the Access Revoke pipeline is missing, contact Zonitix support.
- "The previous run is still open (skip-if-open is on)."
- You clicked Run now on a schedule whose last campaign is not finished, and the schedule is set to skip in that case. Close that campaign first, or switch off Skip if previous still open.
- Drift always shows 0.
- Drift needs real app usage to compare against: apps connected in SaaS Discovery, and a campaign using Actual usage or Both. Without that, every item is Zonitix directory access.
Still stuck? See When something goes wrong, or Contact Zonitix support.