Scheduled campaigns
Run reviews on a cadence rather than as a fire drill before an audit, with progress visible while they are open.
Reviews that produce evidence, not spreadsheets
Scheduled review campaigns, including orphan-account and full-identity reviews, decided in the console.
Access reviews fail when they are run on exported spreadsheets: the data is stale before it is circulated, the decisions are recorded in email, and nothing is enforced at the end. Certification campaigns run on live entitlement data, reviewers decide in the console, and the revocations they choose are carried out rather than noted.
How Access Certification works
The mechanics behind the capability — what the platform does, and where it does it.
Orphan-account reviews
Target the accounts with no valid owner specifically, since those are the ones least likely to be caught by a manager review.
Full-identity reviews
Review everything a person holds in one pass, which gives the reviewer the context to judge whether the combination is reasonable.
Decisions are enforced
A revoke decision results in the entitlement actually being removed, rather than a note that someone must action later.
What it changes
Who feels the difference once Access Certification is in place, and how.
Audit
Audit evidence as a by-product
The campaign record is the evidence, so preparing for an audit stops being a separate project.
Line managers
Reviewers can actually decide
Seeing real entitlements in context produces better decisions than approving rows in a spreadsheet.
Security
Accumulated access gets removed
Regular review is the mechanism that reverses privilege creep once it has happened.
Identity teams
No end-of-campaign backlog
Because decisions are enforced as they are made, nothing waits on a manual clean-up pass.
See Access Certification in context
It works because the other capabilities share the same identity fabric. The quickest way to judge that is to watch it run against your own use cases.