# Access Reviews Overview

Access reviews let an organization take a point-in-time snapshot of identities and permissions, record reviewer decisions, and preserve the result of the campaign. Sources can be connected providers or CSV data exported from another system.

## How It Works

1. Create one or more access sources.
2. Create a campaign and attach the sources that define its scope.
3. Start the campaign to fetch and snapshot available access entries.
4. Review entries, add [flags](/docs/product/access-review/campaigns#flags) where useful, and record decisions.
5. Complete the campaign after every entry has a decision.

Campaign statistics describe the current review state. The snapshot remains separate from the provider’s live directory, so remediation in a provider does not silently rewrite the decision history.

See [Run an Access Review Campaign](/docs/product/access-review/campaigns) for the complete console workflow.

## What Probo Collects

For each account in a review, Probo shows the following, wherever the provider exposes it. Fields the provider doesn't return are left blank.

| Field      | What it tells reviewers                                 |
| ---------- | ------------------------------------------------------- |
| Name       | The account holder's name (service accounts are marked) |
| Email      | The account's email address                             |
| Role       | The role(s) the account holds in the provider           |
| Admin      | Whether the account has administrator access            |
| Status     | Whether the account is active or disabled               |
| MFA        | Whether multi-factor authentication is enabled          |
| Last login | When the account last signed in or was used             |

## Connection Methods

- **OAuth.** When **Add Source** offers **Connect** for a provider, Probo sends you to that provider's consent screen. Availability depends on the provider and your Probo deployment.
- **API key or client credentials.** You generate a credential on the provider and paste it into Probo. The credential type and required permissions vary, so check the [Connector Directory](/docs/product/access-review/directory).
- **CSV.** Paste an exported account list for a system Probo cannot connect to directly. See [Create a CSV Access Source](/docs/product/access-review/csv-sources).

Access reviews live under **Access Reviews** in your organization: the **Sources** tab connects providers, the **Campaigns** tab runs reviews.

See [How Probo Protects Integration Credentials](/docs/product/access-review/integration-security) for encryption, access control, and data handling.

## Review Boundaries

Provider APIs expose different fields and may omit MFA, login, status, or role information. A blank value means the source did not provide it; it should not be interpreted as a passing or failing control. Reviewers remain responsible for deciding whether an identity and its access are appropriate.

Recording a decision does not change the account in the provider. Complete revocations and role changes in the source system, then use the campaign record as evidence of the review.

## Automation

- [CLI access-review](/docs/developers/cli/commands/access-review) — Manage sources and campaigns with prb access-review
- [MCP access reviews](/docs/developers/api/mcp/tools/catalog/access-reviews) — Operate access reviews from supported AI tools
- [n8n Access Review](/docs/developers/api/n8n/resources/access-review) — Automate campaign workflows in n8n