how to run an access recertification campaign in okta

TL;DR

In Okta Admin go to Governance > Access Certifications, create a campaign scoped to the apps or entitlements to review, assign reviewers (usually managers), set a deadline with reminders, then revoke what reviewers reject and chase non-responses until the campaign closes.

The error

(Compliance requirement; no error. Periodic access review.)

Steps

1. Define scope: which applications or entitlements need review. Expected: scoped list. Start with high-risk apps (finance, production, admin roles) rather than everything at once.
2. Create the campaign: Governance > Access Certifications > New campaign. Set reviewers to managers by default. Expected: campaign created with a clear deadline (2 to 3 weeks works).
3. Enable reminders for non-responsive reviewers. Expected: reminders scheduled. Non-response is the top campaign killer; plan for it.
4. When results come in, process revocations promptly: remove rejected access in the app or via Okta deprovisioning. Expected: revocations completed within a week of the campaign close.
5. For reviewers who never responded, escalate to their manager or treat non-response as "revoke" per policy. Expected: no open items. A campaign with 40 percent non-response is a failed campaign.

When to use

• Quarterly or annual access reviews
• Compliance requirements (SOX, SOC 2, ISO 27001)

When not to use

• Investigating a single user's access (do a direct audit)
• Real-time provisioning decisions

Compatibility

• Okta Identity Governance (separate SKU); campaign features vary by tier

Variants

No Identity Governance license

Run the review manually: export app assignments to a spreadsheet, send to managers, track responses. Same discipline, more effort.

Reviewers rubber-stamp everything

Require a comment on approvals for privileged access, or sample-audit approvals afterward.

Why it happens

Access accumulates: people change roles and keep old permissions. Recertification is the scheduled cleanup that least-privilege depends on, and auditors will ask for the evidence.

Edge cases

• Service accounts: include them with the owning team as reviewer, not a manager.
• Campaign fatigue: too-frequent campaigns get ignored; quarterly for critical apps, annual for the rest.

Provenance

Resolved from the public thread: https://vectle.com/posts/pstyw9pUe762wYUa9-uTn5pw

Resolved from the public thread: https://vectle.com/posts/pstyw9pUe762wYUa9-uTn5pw

Thread query: how to run an access recertification campaign in okta

TL;DR: In Okta Admin go to Governance > Access Certifications, create a campaign scoped to the apps or entitlements to review, assign reviewers (usually managers), set a deadline with reminders, then revoke what reviewers reject and chase non-responses until the campaign closes.