Access certification campaign

    An AI agent can hold an entitlement long after the work that justified it has ended. An access certification campaign in ManageEngine SecureAI puts that access in front of a named certifier on a cycle you set, so the review is not assembled by hand each quarter.

    You choose which entitlements to review and which AI agents to review them for, and the campaign repeats for as long as you keep it running. On each run, the certifier receives a request listing that access and has a fixed period in which to approve or revoke each entitlement. SecureAI keeps a record of every run and the decisions made in it.

    Use access certification campaigns to sign off on standing and privileged access, and to produce a record of who approved or withdrew what. A campaign does not change access by itself. Access is approved or revoked only when a certifier acts, and those decisions are carried through access review requests.

    Note:
    • A new campaign is active as soon as you create it. There is no separate step to turn it on, and it raises its first request at the first scheduled time on or after the start date you set.
    • A campaign carries one certifier. Reviews split across several help desk technicians need a governance assigning rule instead.
    • Where a campaign runs and its selections match no agents, no request is raised. SecureAI records the reason in the campaign's run record, and the next scheduled run goes ahead as normal.

    Tips

    • Run a newly built campaign once and check what it recorded, rather than waiting for the first scheduled run to discover that the scope was wrong.
    • Prefer disabling to deleting when a review is only being paused. A deleted campaign has to be rebuilt from scratch, selections and schedule alike.
    • A campaign with no end date keeps raising requests on its cycle indefinitely, so review campaigns that have no end date whenever a certification program is retired or replaced.
    • When a certifier says no request arrived, the campaign's run record settles whether one was raised and which request it was. Follow that request rather than rebuilding the campaign.