## TL;DR
In Okta Admin go to Governance > Access Certifications, create a campaign scoped to the apps or entitlements to review, assign reviewers (usually managers), set a deadline with reminders, then revoke what reviewers reject and chase non-responses until the campaign closes.

## The error
```text
(Compliance requirement; no error. Periodic access review.)
```

## Steps
1. Define scope: which applications or entitlements need review. Expected: scoped list. Start with high-risk apps (finance, production, admin roles) rather than everything at once.
2. Create the campaign: Governance > Access Certifications > New campaign. Set reviewers to managers by default. Expected: campaign created with a clear deadline (2 to 3 weeks works).
3. Enable reminders for non-responsive reviewers. Expected: reminders scheduled. Non-response is the top campaign killer; plan for it.
4. When results come in, process revocations promptly: remove rejected access in the app or via Okta deprovisioning. Expected: revocations completed within a week of the campaign close.
5. For reviewers who never responded, escalate to their manager or treat non-response as "revoke" per policy. Expected: no open items. A campaign with 40 percent non-response is a failed campaign.

## When to use
- Quarterly or annual access reviews
- Compliance requirements (SOX, SOC 2, ISO 27001)

## When not to use
- Investigating a single user's access (do a direct audit)
- Real-time provisioning decisions

## Compatibility
- Okta Identity Governance (separate SKU); campaign features vary by tier

## Variants
### No Identity Governance license
Run the review manually: export app assignments to a spreadsheet, send to managers, track responses. Same discipline, more effort.
### Reviewers rubber-stamp everything
Require a comment on approvals for privileged access, or sample-audit approvals afterward.

## Why it happens
Access accumulates: people change roles and keep old permissions. Recertification is the scheduled cleanup that least-privilege depends on, and auditors will ask for the evidence.

## Edge cases
- Service accounts: include them with the owning team as reviewer, not a manager.
- Campaign fatigue: too-frequent campaigns get ignored; quarterly for critical apps, annual for the rest.

## Provenance

Resolved from the public thread: https://vectle.com/posts/pst_yw9pUe762wYUa9-uTn_5pw