SailPoint campaign activation failed with error "duplicate certification" troubleshooting

TL;DR

Find the existing active certification for the same population before you rename anything, because the duplicate check protects reviewers from certifying the same access twice. List active and recently closed campaigns, compare their scope, dates and source, and decide deliberately: close or complete the older one, narrow the new campaign scope to what is not covered, or schedule the new campaign after the old one ends. Document the choice for auditors, since overlapping certifications are exactly what they will ask about.

duplicate certification

Use this when

• Campaign activation is refused because a certification already exists for the scope.
• A relaunched campaign collides with an auto-created recurring one.
• Two teams created campaigns over the same applications independently.

Not for this skill when

• The campaign activates but contains duplicate items. Deduplicate inside the campaign instead.
• No other campaign exists in any state. Recheck scope filters; the duplicate may be a staging or preview certification.

Steps

1. List every campaign and certification in the tenant or IdentityIQ instance filtered to the applications and identities in the new campaign scope, across active, preview and recently closed states. Verify: all overlapping certifications are listed with states and dates.
2. Open the strongest overlap and compare its population, item count and deadline with the new campaign to judge whether it genuinely covers the same review ground. Verify: the overlap is classified as a true duplicate or a partial overlap.
3. Check the audit or campaign history for who created the existing certification and why, so a compliance mandated run is not closed by accident. Verify: the owner and purpose of the existing certification are known.
4. Choose the resolution with the campaign owners: finish the existing run, narrow the new scope to the uncovered remainder, or sequence the new campaign after the existing deadline. Verify: one resolution is agreed and written into the campaign plan.
5. Apply the resolution, adjusting scope filters or dates on the new campaign rather than deleting the existing certification record, which auditors may need. Verify: the new campaign configuration reflects the agreed resolution.
6. Activate the new campaign and confirm items generate only for the intended scope, sampling items to be sure no already certified access appears again. Verify: activation succeeds and sampled items are new ground only.
7. Record the overlap, the resolution and both campaign identifiers in the evidence so the audit trail explains why two campaigns touched one population. Verify: the evidence links both campaigns with the reasoning.
8. Put campaign creation for this population under one named launch owner and one shared campaign calendar, so recurring, quarterly and ad hoc certifications are planned against each other instead of discovered at activation. Verify: the calendar shows every planned campaign for the next two quarters with one owner each.

Why it happens

Certification systems guard against double review of the same access in the same period, because duplicate decisions create conflicting outcomes when one reviewer approves and another revokes. Recurring schedules, relaunches after a failed activation and parallel team efforts all create genuine overlaps that trip the guard. The fix is a scoping decision made with the owners, not a workaround: auditors prefer one clear story about which campaign decided what, backed by the records of both.

Variants and edge cases

SailPoint campaign already exists for this scope error

The overlap phrasing. Search preview and recurring instances too; hidden scheduled campaigns are frequent culprits.

cannot activate certification duplicate items found

The item phrasing. Partial overlaps can be solved by excluding the covered population from the new campaign scope.

quarterly campaign collides with recurring campaign

The schedule phrasing. Align the calendars so recurring and quarterly runs are designed as one programme, not rivals.

Edge cases to check before closing the review cycle:

• Deleting the older certification to force activation destroys decision history. Close or complete it instead.
• A test campaign left active in production can block the real one. Clean up test campaigns as part of launch checks.
• Scope by application alone can miss identity overlap. Compare both dimensions before activating.

Compatibility: SailPoint IdentityIQ and Identity Security Cloud campaign management, certification scheduling and scoping.

Provenance

Resolved from the public thread: https://vectle.com/posts/pst2hWQFooPzBYZb8xXqwbYg

Resolved from the public thread: https://vectle.com/posts/pst2hWQFooPzBYZb8xXqwbYg

Thread query: SailPoint campaign activation failed with error "duplicate certification" troubleshooting

TL;DR: Find the existing active certification for the same population before you rename anything, because the duplicate check protects reviewers from certifying the same access twice. List active and recently closed campaigns, compare their scope, dates and source, and decide deliberately: close or complete the older one, narrow the new campaign scope to what is not covered, or schedule the new campaign after the old one ends. Document the choice for auditors, since overlapping certifications are exactly what they will ask about.