Run an Access Review Campaign

An access review campaign takes a point-in-time snapshot of the accounts available from one or more access sources. Reviewers can then flag accounts, record a decision for every entry, and preserve the completed review.

Before you begin, create at least one access source. Connect a provider from the Connector Directory, or create a CSV source.

Create a Campaign

1. In Probo, open your organization and go to Access Reviews > Campaigns.
2. Click New campaign.
3. Enter a Name and, optionally, a Description.
4. Select the sources that belong in the review, then click Create.

The campaign starts in Draft. Open it to add another source before starting. A campaign must contain at least one source.

Tip

Give the campaign a name that identifies its period and purpose, such as Q3 2026 privileged access review. A clear name makes the preserved review easier to identify later.

Start the Campaign

Review the source list, then click Start campaign. Probo queues a fetch for every source and changes the campaign status to In progress.

Each source shows its fetch status and the number of accounts returned:

• Queued or Fetching means collection is still running.
• Success means the source snapshot is ready.
• Failed shows the provider error. Resolve the source or credential problem before relying on the campaign.

After collection finishes, the campaign moves to Pending actions. Starting the campaign fixes its scope: you cannot add or remove sources after this point.

Review Accounts

Expand each source to review its accounts. Depending on what the provider exposes, Probo displays name, email, role, administrator status, account status, MFA status, and last login.

For each account:

1. Check the identity, assigned role, administrative access, status, MFA, and recent activity.
2. Add any useful flags that describe what you found.
3. Record one of these decisions:
   • Approve: the current access is appropriate.
   • Revoke: the access should be removed.
   • Modify: the account should remain, but its access should change.
   • Escalate: another reviewer or owner must decide.

Approve records immediately. Revoke, Modify, and Escalate require a note explaining the decision. You can select several accounts to apply a decision or flags in bulk.

Note

A decision records the review outcome; it does not change access in the connected provider. Complete any required remediation in that provider and retain the decision note as evidence.

Flags

Flags are optional labels reviewers attach to an account during a campaign. They do not replace a decision: every entry still needs Approve, Revoke, Modify, or Escalate before the campaign can complete. Use flags to call out risk themes, group similar findings, and leave clearer evidence for auditors.

An entry can carry more than one flag. You can set flags on a single account or apply them in bulk to a selection.

Account

Flag	Use when
Orphan account	The account has no clear owner, or it no longer maps to a known person in the organization.
Dormant	The account looks unused for a long period relative to your review policy.
Terminated user	The person has left the organization and the account should no longer have access.
Contractor expired	A contractor or temporary worker’s engagement has ended, but the account remains.

Privileges

Flag	Use when
Excessive privileges	The account has more access than the role or job requires.
SoD conflict	The account combines duties that your segregation-of-duties policy separates.
Privileged access	The account holds elevated or administrative rights that deserve explicit review.
Role creep	Access has accumulated over time beyond what the current role needs.

Anomaly

Flag	Use when
No justification	There is no clear business reason for the account or its level of access.
Out of department	The account belongs outside the team or department that should own this system.
Shared account	More than one person uses the same login, or the account is otherwise shared.

Flags are reviewer annotations. Probo does not auto-detect them from provider data; choose them based on what the snapshot and your internal context show.

Complete the Campaign

The Complete campaign action becomes available after every entry has a decision.

1. Confirm that no entries remain pending.
2. Confirm that failed source fetches have been investigated.
3. Click Complete campaign, then confirm.

Completion finalizes the decisions and changes the campaign status to Completed. This action cannot be undone.

Campaign Statuses

stateDiagram-v2
  state "Draft" as draft
  state "In progress" as inProgress
  state "Pending actions" as pending
  state "Completed" as completed
  state "Cancelled" as cancelled

  [*] --> draft: Create campaign with sources
  draft --> inProgress: Start campaign
  inProgress --> pending: Source fetches finish
  pending --> completed: Every entry has a decision
  draft --> cancelled: Cancel through API or CLI
  pending --> cancelled: Cancel through API or CLI
  completed --> [*]

Campaign statuses and the transitions between them. Sources can be added while a campaign is a draft; the scope is fixed once it starts.

Status	Meaning
Draft	Sources can still be added and the campaign has not fetched accounts.
In progress	Probo is fetching accounts from the selected sources.
Pending actions	Collection finished and entries are ready for decisions.
Completed	Every entry has a finalized decision and the campaign is closed.
Cancelled	The campaign was cancelled through the API or CLI and is no longer active.

The console can delete any campaign that is not In progress. Deletion permanently removes the campaign, so do not use it as a substitute for completing a review that must be retained as evidence.

For automation, see the CLI access-review commands.