# Run an Access Review Campaign An access review campaign takes a point-in-time snapshot of the accounts available from one or more access sources. Reviewers can then flag accounts, record a decision for every entry, and preserve the completed review. Before you begin, create at least one access source. Connect a provider from the [Connector Directory](/docs/product/access-review/directory), or [create a CSV source](/docs/product/access-review/csv-sources). ## Create a Campaign 1. In Probo, open your organization and go to **Access Review** > **Campaigns**. 2. Click **New campaign**. 3. Enter a **Name** and, optionally, a **Description**. 4. Select the sources that belong in the review, then click **Create**. The campaign starts in **Draft**. Open it to add another source before starting. A campaign must contain at least one source. :::tip Give the campaign a name that identifies its period and purpose, such as `Q3 2026 privileged access review`. A clear name makes the preserved review easier to identify later. ::: ## Start the Campaign Review the source list, then click **Start campaign**. Probo queues a fetch for every source and changes the campaign status to **In progress**. Each source shows its fetch status and the number of accounts returned: - **Queued** or **Fetching** means collection is still running. - **Success** means the source snapshot is ready. - **Failed** shows the provider error. Resolve the source or credential problem before relying on the campaign. After collection finishes, the campaign moves to **Pending actions**. Starting the campaign fixes its scope: you cannot add or remove sources after this point. ## Review Accounts Expand each source to review its accounts. Depending on what the provider exposes, Probo displays name, email, role, administrator status, account status, MFA status, and last login. For each account: 1. Check the identity, assigned role, administrative access, status, MFA, and recent activity. 2. Add any useful [flags](#flags) that describe what you found. 3. Record one of these decisions: - **Approve**: the current access is appropriate. - **Revoke**: the access should be removed. - **Modify**: the account should remain, but its access should change. - **Escalate**: another reviewer or owner must decide. Approve records immediately. Revoke, Modify, and Escalate require a note explaining the decision. You can select several accounts to apply a decision or flags in bulk. :::note A decision records the review outcome; it does not change access in the connected provider. Complete any required remediation in that provider and retain the decision note as evidence. ::: ## Flags Flags are optional labels reviewers attach to an account during a campaign. They do not replace a decision: every entry still needs Approve, Revoke, Modify, or Escalate before the campaign can complete. Use flags to call out risk themes, group similar findings, and leave clearer evidence for auditors. An entry can carry more than one flag. You can set flags on a single account or apply them in bulk to a selection. ### Account | Flag | Use when | | -------------------- | ------------------------------------------------------------------------------------------------- | | Orphan account | The account has no clear owner, or it no longer maps to a known person in the organization. | | Dormant | The account looks unused for a long period relative to your review policy. | | Terminated user | The person has left the organization and the account should no longer have access. | | Contractor expired | A contractor or temporary worker's engagement has ended, but the account remains. | ### Privileges | Flag | Use when | | ---------------------- | ------------------------------------------------------------------------------------------------- | | Excessive privileges | The account has more access than the role or job requires. | | SoD conflict | The account combines duties that your segregation-of-duties policy separates. | | Privileged access | The account holds elevated or administrative rights that deserve explicit review. | | Role creep | Access has accumulated over time beyond what the current role needs. | ### Anomaly | Flag | Use when | | ----------------- | ------------------------------------------------------------------------------------------------- | | No justification | There is no clear business reason for the account or its level of access. | | Out of department | The account belongs outside the team or department that should own this system. | | Shared account | More than one person uses the same login, or the account is otherwise shared. | Flags are reviewer annotations. Probo does not auto-detect them from provider data; choose them based on what the snapshot and your internal context show. ## Complete the Campaign The **Complete campaign** action becomes available after every entry has a decision. 1. Confirm that no entries remain pending. 2. Confirm that failed source fetches have been investigated. 3. Click **Complete campaign**, then confirm. Completion finalizes the decisions and changes the campaign status to **Completed**. This action cannot be undone. ## Campaign Statuses | Status | Meaning | | --------------- | -------------------------------------------------------------------------- | | Draft | Sources can still be added and the campaign has not fetched accounts. | | In progress | Probo is fetching accounts from the selected sources. | | Pending actions | Collection finished and entries are ready for decisions. | | Completed | Every entry has a finalized decision and the campaign is closed. | | Cancelled | The campaign was cancelled through the API or CLI and is no longer active. | The console can delete any campaign that is not **In progress**. Deletion permanently removes the campaign, so do not use it as a substitute for completing a review that must be retained as evidence. For automation, see the [CLI access-review commands](/docs/developers/cli/commands/access-review).