diff --git a/product/admin/access-conflicts.mdx b/product/admin/access-conflicts.mdx
index 6063352..41a6a89 100644
--- a/product/admin/access-conflicts.mdx
+++ b/product/admin/access-conflicts.mdx
@@ -4,7 +4,7 @@ og:title: Detect access conflicts - ConductorOne docs
og:description: Set up conflict monitors to automatically track and alert on combinations of access that violate separation of duties policies or regulations such as SOX, FDA 21 CFR Part 11, and ISO 27001.
description: Set up conflict monitors to automatically track and alert on combinations of access that violate policies or regulations.
---
-{/* Editor Refresh: 2026-01-07 */}
+{/* Editor Refresh: 2026-03-02 */}
## What's an access conflict?
@@ -120,6 +120,12 @@ To learn more about a conflict and see its log of past actions, click its ***...
+## Review access conflicts in a campaign
+
+You can use your conflict monitors to scope an [access review campaign](/product/admin/campaigns). When you create a campaign and select the **Review access conflicts** scope type, ConductorOne generates review tasks for users who have active violations detected by your conflict monitors. This lets you systematically review and remediate separation of duties violations across your organization.
+
+To set up an access conflict campaign, see [Create an access review campaign](/product/admin/campaigns#step-2-choose-what-to-review).
+
## Generate reports
Generate a report of the conflict monitor's alerts, their current state, and all audit log entries by clicking the **Generate CSV** icon. Your report will be prepared for you and posted in the downloads center at the top of the page when ready.
diff --git a/product/admin/campaigns.mdx b/product/admin/campaigns.mdx
index d4397d9..5e0211b 100644
--- a/product/admin/campaigns.mdx
+++ b/product/admin/campaigns.mdx
@@ -1,11 +1,11 @@
---
title: Create an access review campaign
og:title: Create an access review campaign - ConductorOne docs
-og:description: Create one-time user access review (UAR) campaigns or reusable campaign templates that can be run on a schedule.
-description: Create one-time user access review (UAR) campaigns or reusable campaign templates that can be run on a schedule.
+og:description: Create one-time user access review (UAR) campaigns or reusable campaign templates that can be run on a schedule. Scope campaigns by entitlements or by access conflicts.
+description: Create one-time user access review (UAR) campaigns or reusable campaign templates. Scope campaigns by entitlements or by access conflicts from your conflict monitors.
sidebarTitle: Create a campaign
---
-{/* Editor Refresh: 2026-02-01 */}
+{/* Editor Refresh: 2026-03-02 */}
## Why run an access review campaign?
@@ -13,7 +13,7 @@ Access review campaigns help Security and IT teams to securely control what soft
From a least privilege and security perspective, ensuring that users only have the access they need, for only as long as they need it, reduces the access footprint of your company for sensitive systems and data. Running regular access review campaigns also helps you to achieve compliance with security standards and audit requirements.
-## View all campaigns
+## View all campaigns
On the **Campaigns** page, campaigns are sorted by state and type:
@@ -29,9 +29,9 @@ On the **Campaigns** page, campaigns are sorted by state and type:
* **Templates** are saved campaign outlines used to create one-time or recurring scheduled campaigns.
-## How do campaign templates work?
+## How do campaign templates work?
-If there's a campaign pattern you use repeatedly, create a reusable campaign template instead of configuring the same campaign from scratch every time.
+If there's a campaign pattern you use repeatedly, create a reusable campaign template instead of configuring the same campaign from scratch every time.
@@ -45,24 +45,24 @@ Once a campaign template is set up, use it to create single campaigns whenever y
Duplicate any existing campaign from the **...** (more actions) menu on the **Running**, **Drafts**, or **Completed** tabs.
-## Create a new campaign
+## Create a new campaign
{/* header name used in links, change with caution */}
-Follow this process to create a single campaign. Jump to [Create a campaign template](/product/admin/campaigns#create-a-campaign-template) to set up a template that can be used to create many similar campaigns.
+Follow this process to create a single campaign. Jump to [Create a campaign template](/product/admin/campaigns#create-a-campaign-template) to set up a template that can be used to create many similar campaigns.
-Only users with the **Campaign Administrator** or **Super Administrator** [user roles](/product/admin/user-roles) in ConductorOne can create and manage campaigns. Campaign admins can only manage the campaigns that they also own.
+Only users with the **Campaign Administrator** or **Super Administrator** [user roles](/product/admin/user-roles) in ConductorOne can create and manage campaigns. Campaign admins can only manage the campaigns that they also own.
### Step 1: Set up the campaign
-Navigate to **Governance** > **Campaigns**.
+Navigate to **Governance** > **Campaigns**.
-Click **New campaign**.
+Click **New campaign**.
@@ -72,199 +72,186 @@ Fill out the form, providing the following information:
- **Description**: The description of what this campaign entails and any directions you want to deliver to reviewers.
- - **Campaign type**: Select **Single instance**, then set the **Target completion date** for the campaign.
+ - **Campaign type**: Select **Single instance**, then set the **Target completion date** for the campaign.
- **Owner**: The campaign's owner, who will manage the campaign while it is in progress. You can set more than one campaign owner. Each owner must have the Campaign Administrator or Super Administrator user role in ConductorOne.
- **Review policy**: The campaign's default [review policy](/product/admin/policies). If needed, you'll be able to adjust the policy to be used for the review of individual entitlements later in the campaign creation process.
-Click **Continue**. The campaign is created.
+Click **Continue**. The campaign is created.
-### Step 2: Configure how the campaign will run
+### Step 2: Choose what to review
+
+Next, define the scope of resources that your campaign will review.
+
-On the new campaign's **Configuration** tab, review and update the details you've entered so far.
-
-
-If you want to provide any instructions to reviewers about how to complete access reviews in this campaign, click **Edit** and enter the instructions in the **Review instructions** field.
+On the **Scope** tab of your campaign, click the **Apps and resources** section to make initial scoping selections. Available scope types:
- The instructions you enter will be displayed to all reviewers at the top of the page where they complete their access reviews. You can format your instructions using Markdown to add emphasis, links, and structure.
-
-
-If you want all reviewers to receive their campaign tasks in the same format, select a **Default access review view**:
+ - **Review specific resources** — Use this option to review access to specific permissions. If you use this option, you can edit the scope to remove entitlements from the review or update the policy used to review specific entitlements.
- - **By application:** review access to one application at a time
+ - **Review application access** — Use this option to review access to specific applications.
- - **By user:** review one user’s access at a time
+ - **Review resource types** — Use this option to review all resources of a given type within a specific application (such as all groups within Slack).
- - **Unstructured:** all the assigned reviews together in one list
+ - **Review access conflicts** — Review access violations associated with users, based on your configured [conflict monitors](/product/admin/access-conflicts). Use this option to run a targeted review of users who hold combinations of access that violate separation of duties (SoD) policies.
- If a default view is selected, each reviewer's access reviews will open in that view, but individual reviewers can switch to a different view if desired.
-
-
-By default, all campaign tasks will be created using the review policy you chose. If instead you want campaign tasks to use the review policies set on the entitlements or apps in the campaign, click **Edit** and click to turn on **Use preferred review policies**.
+
+ **Reviewing access conflicts?** You must have at least one enabled [conflict monitor](/product/admin/access-conflicts) configured before you can scope a campaign by access conflicts.
+
- If this option is enabled, ConductorOne will apply policies using this order of precedence: entitlement, application, campaign.
+
+ **You can only use one scope type per campaign.** If you want to review both application access and specific resources in a single campaign, select **Review specific resources** and add the relevant entitlements.
+
-
-By default, campaigns are started and ended manually. If you want to automatically start or end the campaign, find the **Schedule** section of the page and click **Edit**.
+
- - To automatically start the campaign on a specific date and time, click to turn on **Automatically start campaign**, then set the scheduled start date.
+To further refine the scope of your campaign, you can filter by user, account, and/or grant criteria. If you do not make any selections here, all users with access to the apps or resources you selected above will be added to the campaign.
- - If the campaign is set to automatically start, choose whether to proceed with auto-start if there are unresolved campaign data accuracy issues. Campaign owners will be notified of any data accuracy issues when they are discovered.
+**Optional. User selection:** Find the **User selection** section of the page and click **Make selections**. If you want to narrow the focus of the UAR:
- - To automatically end the campaign on a specific date, click to turn on **Automatically end campaign**, then set the date.
+ - Click **Select specific users** to build a list of users whose access will be reviewed, then click **Save**.
- - If the campaign is set to automatically end, choose whether incomplete reviews will be revoked or skipped when the campaign ends.
-
-
-In the **Notifications and reporting** section, you can configure what notifications the campaign will automatically generate:
+ **OR**
- * Notify all reviewers with assigned review tasks when the campaign begins
-
- * Notify all campaign owners and reviewers when the campaign ends
+ - Click **Select users by criteria** to review users who match the criteria you set, then click **Save**.
- * When the campaign is complete, enerate a campaign report and notify all campaign owners when it's ready for download
+ You can mix and match these options:
- If you do not pre-configure these options here, you'll have another chance to send out notifications and generate a report when ending the campaign.
-
-
-If you want to use a Slack channel for communication about this campaign, click **Add Slack channel**. Enter a Slack channel name, either an existing channel in your workspace or the name for a new channel you want to create.
+ - User status in ConductorOne
- All campaign owners and users assigned access reviews will be automatically added to this channel when the campaign starts.
+ - Direct reports of a manager
-
- **Sending campaign notifications to a private Slack channel?** Make sure the [ConductorOne Slack app](/product/admin/slack-application) is added to the channel before you confiugre it here, or the notifications won't be delivered.
-
-
-
+ - [User profile attributes](/product/admin/attributes). For example, to run an access review campaign on all the AcmeApp users in your company with the job title "Engineer", create the parameter **User AcmeJob is Engineer**.
-### Step 3: Choose what to review
+ - Exclude users in specific groups from the campaign
-Next, build a list of the resources that your campaign will review.
+ **OR**
-
-
-On the **Scope** tab of your campaign, find the **Apps and resources** section of the page and click **Make selections**.
+ - Click **CEL expression** to enter a [CEL expression](/product/admin/expressions) that describes the users you want to review. The expression must return a list of users to be valid.
- - To run a UAR on user access to specific permissions, click **Review specific resources** and select resources, then click **Save**.
+**Optional. Account parameters:** Find the **Account parameters** section of the page and click **Make selections**. If you want to narrow the focus of the UAR:
- **OR**
+ - Click **Select accounts by criteria** to review app accounts that match the criteria you set, then click **Save**.
- - To run a UAR on user access to applications, click **Review application access** and select apps, then click **Save**.
+ You can mix and match these options:
- **OR**
+ - No account owner
- - To run a UAR on all of the resources of a given resource type within a specific app (such as all the groups within Google Workspace), click **Review resources by type** and select the resource types for each applicable application, then click **Save**.
+ - Account status
-
- **You cannot mix selections from the three tabs in a single campaign.** If you want to review both application access and non-access resources in a single campaign, select **Review specific resources** or **Review resources by type** and add the **Credential** resource type to the campaign.
-
-
-
-If you're building a UAR reviewing specific resources, click **Edit scope** to remove entitlements from the review or update the policy used to review specific entitlements. Click **Apply changes** when you're finished.
+ - Account type
-
- 
-
-
-
-**Optional.** Find the **User selection** section of the page and click **Make selections**.
+ - Account domain (specifically, whether the email address associated with the account has been [marked trusted](/product/admin/global-settings#set-trusted-domains) by a C1 admin at your organization)
- If you don't make any selections here, all users with access to the apps or resources you selected above will be added to the campaign. If you want to narrow the focus of the UAR:
+ **OR**
- - Click **Select specific users** to build a list of users whose access will be reviewed, then click **Save**.
+ - Click **CEL expression** to enter a [CEL expression](/product/admin/expressions) that describes the accounts you want to review. The expression must return a list of accounts to be valid.
- **OR**
+**Optional. Grant parameters:** Find the **Grant parameters** section of the page and click **Make selections**. If you want to narrow the focus of the UAR:
- - Click **Select users by criteria** to review users who match the criteria you set, then click **Save**.
+ - Click **Select grants by criteria** to review only the access grants that match the criteria you set, then click **Save**.
- You can mix and match these options:
+ You can mix and match these options:
- - User status in ConductorOne
+ - New grants added within the time period you select or between two specific dates
- - Direct reports of a manager
+ - Temporary (time-limited) or permanent grants
- - [User profile attributes](/product/admin/attributes). For example, to run an access review campaign on all the AcmeApp users in your company with the job title "Engineer", create the parameter **User AcmeJob is Engineer**.
+ - Grants that have not been used in the time period you select (this information is not available for all applications)
- - Exclude users in specific groups from the campaign
+ - Direct grants (permissions assigned directly to users) or inherited grants (permissions assigned to a group or role, which are "inherited" by users assigned to that group or role)
- **OR**
+ - Grants sourced from access profiles (check the box to exclude these grants from your campaign)
+
+A summary of your choices is shown on the **Scope** tab. Click **Validate scope** at any time to generate a report showing a preview of the campaign based on the current scope.
- - Click **CEL expression** to enter a [CEL expression](/product/admin/expressions) that describes the users you want to review. The expression must return a list of users to be valid.
+Once you're satisfied with your selections, move on to the next step.
+### Step 3: Configure how the campaign will run
+
+
+On the new campaign's **Configuration** tab, review and update the details you've entered so far.
-**Optional.** Find the **Account parameters** section of the page and click **Make selections**.
+If you want to provide any instructions to reviewers about how to complete access reviews in this campaign, click **Edit** and enter the instructions in the **Review instructions** field.
- If you don't make any selections here, all accounts with access to the apps or resources you selected above will be added to the campaign. If you want to narrow the focus of the UAR:
+ The instructions you enter will be displayed to all reviewers at the top of the page where they complete their access reviews. You can format your instructions using Markdown to add emphasis, links, and structure.
+
+
+If you want all reviewers to receive their campaign tasks in the same format, select a **Default access review view**:
- - Click **Select accounts by criteria** to review app accounts that match the criteria you set, then click **Save**.
+ - **By application:** review access to one application at a time
- You can mix and match these options:
+ - **By user:** review one user's access at a time
- - No account owner
+ - **Unstructured:** all the assigned reviews together in one list
- - Account status
+ If a default view is selected, each reviewer's access reviews will open in that view, but individual reviewers can switch to a different view if desired.
+
+
+By default, all campaign tasks will be created using the review policy you chose. If instead you want campaign tasks to use the review policies set on the entitlements or apps in the campaign, click **Edit** and click to turn on **Use preferred review policies**.
- - Account type
+ If this option is enabled, ConductorOne will apply policies using this order of precedence: entitlement, application, campaign.
+
+
+By default, campaigns are started and ended manually. If you want to automatically start or end the campaign, find the **Schedule** section of the page and click **Edit**.
- - Account domain (specifically, whether the email address associated with the account has been [marked trusted](/product/admin/global-settings#set-trusted-domains) by a C1 admin at your organization)
+ - To automatically start the campaign on a specific date and time, click to turn on **Automatically start campaign**, then set the scheduled start date.
- **OR**
+ - If the campaign is set to automatically start, choose whether to proceed with auto-start if there are unresolved campaign data accuracy issues. Campaign owners will be notified of any data accuracy issues when they are discovered.
- - Click **CEL expression** to enter a [CEL expression](/product/admin/expressions) that describes the accounts you want to review. The expression must return a list of accounts to be valid.
+ - To automatically end the campaign on a specific date, click to turn on **Automatically end campaign**, then set the date.
+ - If the campaign is set to automatically end, choose whether incomplete reviews will be revoked or skipped when the campaign ends.
-**Optional.** Find the **Grant parameters** section of the page and click **Make selections**.
-
- If you don't make any selections here, all access grants of the apps or resources you selected above will be added to the campaign. If you want to narrow the focus of the UAR:
-
- - Click **Select grants by criteria** to review only the access grants that match the criteria you set, then click **Save**.
+In the **Notifications and reporting** section, you can configure what notifications the campaign will automatically generate:
- You can mix and match these options:
+ * Notify all reviewers with assigned review tasks when the campaign begins
- - New grants added within the time period you select or between two specific dates
+ * Notify all campaign owners and reviewers when the campaign ends
- - Temporary (time-limited) or permanent grants
+ * When the campaign is complete, generate a campaign report and notify all campaign owners when it's ready for download
- - Grants that have not been used in the time period you select (this information is not available for all applications)
+ If you do not pre-configure these options here, you'll have another chance to send out notifications and generate a report when ending the campaign.
+
+
+If you want to use a Slack channel for communication about this campaign, click **Add Slack channel**. Enter a Slack channel name, either an existing channel in your workspace or the name for a new channel you want to create.
- - Direct grants (permissions assigned directly to users) or inherited grants (permissions assigned to a group or role, which are "inherited" by users assigned to that group or role)
+ All campaign owners and users assigned access reviews will be automatically added to this channel when the campaign starts.
- - Grants sourced from access profiles (check the box to exclude these grants from your campaign)
+
+ **Sending campaign notifications to a private Slack channel?** Make sure the [ConductorOne Slack app](/product/admin/slack-application) is added to the channel before you configure it here, or the notifications won't be delivered.
+
-A summary of your choices is shown on the **Scope** tab. Click **Validate scope** at any time to generate a report showing a preview of the campaign based on the current scope.
-
-Once you're satisfied with your selections, move on to the next step.
### Step 4: Check data accuracy
-If any of your selections are sourced from connectors or file uploads that have not been updated recently, you'll see an indicator and a **Your campaign might have data accuracy issues** banner on the **Accuracy** tab.
+If any of your selections are sourced from connectors or file uploads that have not been updated recently, you'll see an indicator and a **Your campaign might have data accuracy issues** banner on the **Accuracy** tab.
-All data sources for your campaign are shown in the **Data sources** table. ConductorOne flags data sources when:
+All data sources for your campaign are shown in the **Data sources** table. ConductorOne flags data sources when:
* A connector hasn't synced for more than two days
* A file source hasn't been updated in more than seven days
* A connector errored during the most recent sync
-Click the eye icon next to a **Last sync** timestamp to view details about the most recent connector sync or file upload.
+Click the eye icon next to a **Last sync** timestamp to view details about the most recent connector sync or file upload.
+
+Click **Sync now** (for connectors) or **Replace file** (for file sources) to update the data source and ensure your campaign is using up-to-date information.
-Click **Sync now** (for connectors) or **Replace file** (for file sources) to update the data source and ensure your campaign is using up-to-date information.
-
**Do I have to resolve all data accuracy issues before I can prepare the campaign?**
-No. This information is presented for your awareness and to help you ensure that your campaign's data is up to date. Resolving data accuracy warnings before proceeding is strongly recommended, but not required.
+No. This information is presented for your awareness and to help you ensure that your campaign's data is up to date. Resolving data accuracy warnings before proceeding is strongly recommended, but not required.
### Step 5: Prepare the campaign
@@ -274,7 +261,7 @@ No. This information is presented for your awareness and to help you ensure that
When you're ready, click **Prepare campaign**. Preparing a campaign generates the individual access review tasks, but does not launch the campaign. Please be patient: depending on the size of the campaign, preparing it might take several minutes.
- **Your campaign is a snapshot of access data as it exists the moment you click this button.** Any access changes or updates to data sources that take place after you prepare the campaign will not be reflected in the campaign.
+ **Your campaign is a snapshot of access data as it exists the moment you click this button.** Any access changes or updates to data sources that take place after you prepare the campaign will not be reflected in the campaign.
@@ -295,52 +282,52 @@ Click **Start campaign**. Again, depending on the size of the campaign, starting
-**That's it!** Your access review campaign is underway. Check out [Manage active campaigns](/product/admin/manage-campaigns) to learn about campaign reminders, reports, and revoking access denied during the campaign.
+**That's it!** Your access review campaign is underway. Check out [Manage active campaigns](/product/admin/manage-campaigns) to learn about campaign reminders, reports, and revoking access denied during the campaign.
## Duplicate a past campaign
{/* header name used in links, change with caution */}
-Only users with the **Campaign Administrator** or **Super Administrator** [user roles](/product/admin/user-roles) in ConductorOne can create and manage campaigns.
+Only users with the **Campaign Administrator** or **Super Administrator** [user roles](/product/admin/user-roles) in ConductorOne can create and manage campaigns.
-Instead of creating a campaign from scratch, you can save time and effort by duplicating a past campaign and tailoring it to your current needs.
+Instead of creating a campaign from scratch, you can save time and effort by duplicating a past campaign and tailoring it to your current needs. Duplicating a campaign is a quick way to reuse a past campaign's settings for a one-off review. If you need to run similar campaigns on a regular schedule, [create a campaign template](/product/admin/campaigns#create-a-campaign-template) instead.
-Navigate to **Governance** > **Campaigns**.
+Navigate to **Governance** > **Campaigns**.
-Locate and click on the name of the campaign that you want to duplicate.
+Locate and click on the name of the campaign that you want to duplicate.
-From the more actions (…) menu, select **Duplicate**.
+From the more actions (…) menu, select **Duplicate**.
Review the campaign's details and update the information as necessary.
-Follow the instructions above to validate, prepare, and start the duplicate campaign.
+Follow the instructions above to validate, prepare, and start the duplicate campaign.
**That's it!** Your duplicated access review campaign is underway.
-## Create a campaign template
+## Create a campaign template
-Only users with the **Campaign Administrator** or **Super Administrator** [user roles](/product/admin/user-roles) in ConductorOne can create and manage campaign templates.
+Only users with the **Campaign Administrator** or **Super Administrator** [user roles](/product/admin/user-roles) in ConductorOne can create and manage campaign templates.
### Step 1: Set up the template
-Navigate to **Governance** > **Campaigns**.
+Navigate to **Governance** > **Campaigns**.
-Click **New campaign**.
+Click **New campaign**.
@@ -350,25 +337,35 @@ Fill out the form, providing the following information:
- **Description**: The description of what this campaign entails and any directions you want to deliver to reviewers.
- - **Campaign type**: Select **Template**, then set the **Campaign duration**, or how long each campaign created from the template will run.
+ - **Campaign type**: Select **Template**, then set the **Campaign duration**, or how long each campaign created from the template will run.
- **Owner**: The campaign's owner, who will manage the campaign while it is in progress. You can set more than one campaign owner, just be sure anyone you add has the Campaign Administrator or Super Administrator user role in ConductorOne.
- **Review policy**: The campaign's default [review policy](/product/admin/policies). If needed, you'll be able to adjust the policy to be used for the review of individual entitlements later in the campaign creation process.
-Click **Continue**. The template is created.
+Click **Continue**. The template is created.
-### Step 2: Configure how campaigns created from this template will run
+### Step 2: Choose what to review
+
+The scope options for templates are the same as for single campaigns. On the **Scope** tab of your template, configure the apps, resources, and filtering criteria for campaigns created from this template.
+
+See [Step 2: Choose what to review](/product/admin/campaigns#step-2-choose-what-to-review) above for details on each scope type and filtering option.
+
+A summary of your choices is shown on the **Scope** tab. Click **Validate scope** at any time to generate a report showing a preview of a campaign made from the template based on the current scope.
-You can set the template to create instances of the campaign on a date in the future or on a recurring schedule. You can also create an on-demand instance of the campaign at any time.
+Once you're satisfied with your selections, move on to the next step.
+
+### Step 3: Configure how campaigns created from this template will run
+
+You can set the template to create instances of the campaign on a date in the future or on a recurring schedule. You can also create an on-demand instance of the campaign at any time.
-**Want to create a campaign from this template right now?**
+**Want to create a campaign from this template right now?**
-On the **Campaigns** tab, click **Create campaign** to create an on-demand draft campaign from the template.
+On the **Campaigns** tab, click **Create campaign** to create an on-demand draft campaign from the template.
@@ -376,50 +373,50 @@ On the **Campaigns** tab, click **Create campaign** to create an on-demand draft
On the new template's **Configuration** tab, review and update the details you've entered so far.
-If you want to provide any instructions to reviewers about how to complete access reviews in campaigns created from this template, click **Edit** and enter the instructions in the **Review instructions** field.
+If you want to provide any instructions to reviewers about how to complete access reviews in campaigns created from this template, click **Edit** and enter the instructions in the **Review instructions** field.
- The instructions you enter will be displayed to all reviewers at the top of the page where they complete their access reviews. You can format your instructions using Markdown to add emphasis, links, and structure.
+ The instructions you enter will be displayed to all reviewers at the top of the page where they complete their access reviews. You can format your instructions using Markdown to add emphasis, links, and structure.
-If you want all reviewers to receive their campaign tasks in the same format, select a **Default access review view**:
+If you want all reviewers to receive their campaign tasks in the same format, select a **Default access review view**:
- **By application:** review access to one application at a time
- - **By user:** review one user’s access at a time
+ - **By user:** review one user's access at a time
- - **Unstructured:** all the assigned reviews together in one list
+ - **Unstructured:** all the assigned reviews together in one list
- If a default view is selected, each reviewer's access reviews will open in that view, but individual reviewers can switch to a different view if desired.
+ If a default view is selected, each reviewer's access reviews will open in that view, but individual reviewers can switch to a different view if desired.
-By default, all campaign tasks will be created using the review policy you chose. If instead you want campaign tasks to use the review policies set on the entitlements or apps in the campaign, click **Edit** and click to turn on **Use preferred review policies**.
+By default, all campaign tasks will be created using the review policy you chose. If instead you want campaign tasks to use the review policies set on the entitlements or apps in the campaign, click **Edit** and click to turn on **Use preferred review policies**.
- If this option is enabled, ConductorOne will apply policies using this order of precedence: entitlement, application, campaign.
+ If this option is enabled, ConductorOne will apply policies using this order of precedence: entitlement, application, campaign.
-**Optional.** If you'd like to automatically create draft instances of this campaign, either once on a date in the future or regularly on a set schedule, go to the **Schedule** area of the page and click **Edit**.
+**Optional.** If you'd like to automatically create draft instances of this campaign, either once on a date in the future or regularly on a set schedule, go to the **Schedule** area of the page and click **Edit**.
- Click to turn on **Schedule**.
+ Click to turn on **Schedule**.
- Choose the date you want a draft instance of this campaign to be created.
+ Choose the date you want a draft instance of this campaign to be created.
- Using the **Frequency** selector, choose a frequency option to automatically create recurring instances of the campaign, beginning on the date you chose and recurring at the frequency you set.
+ Using the **Frequency** selector, choose a frequency option to automatically create recurring instances of the campaign, beginning on the date you chose and recurring at the frequency you set.
Choose **None** if you only want to create a single scheduled instance of the campaign on the date you chose.
- New campaign drafts will be created on the scheduled dates, at around 8:30 AM Pacific time. The template's owners will be notified by email that a new draft campaign has been set up.
+ New campaign drafts will be created on the scheduled dates, at around 8:30 AM Pacific time. The template's owners will be notified by email that a new draft campaign has been set up.
-By default, campaigns created from this template are started and ended manually. If you want to automatically start or end campaigns created from this template, configure these settings:
+By default, campaigns created from this template are started and ended manually. If you want to automatically start or end campaigns created from this template, configure these settings:
- - To automatically start each campaign, click to turn on **Automatically start campaign**. Campaigns will auto-start two days after they are created from this template.
+ - To automatically start each campaign, click to turn on **Automatically start campaign**. Campaigns will auto-start two days after they are created from this template.
- If the campaign is set to automatically start, choose whether to proceed with auto-start if there are unresolved campaign data accuracy issues. Campaign owners will be notified of any data accuracy issues when they are discovered.
- - To automatically end each campaign on the scheduled end date calculated from the campaign duration you set, click to turn on **Automatically end campaign**.
+ - To automatically end each campaign on the scheduled end date calculated from the campaign duration you set, click to turn on **Automatically end campaign**.
- If the campaign is set to automatically end, choose whether incomplete reviews will be revoked or skipped when the campaign ends.
@@ -427,141 +424,47 @@ By default, campaigns created from this template are started and ended manually.
In the **Notifications and reporting** section, configure whether to automatically send out notifications about the campaigns generated from this template:
* Notify all reviewers with assigned review tasks when a campaign begins
-
- * Notify all campaign owners and reviewers when a campaign ends
+
+ * Notify all campaign owners and reviewers when a campaign ends
* When a campaign is complete, generate a campaign report and notify all campaign owners when it's ready for download
- If you do not pre-configure these options here, you'll have another chance to send out notifications and generate a report when ending the campaign.
+ If you do not pre-configure these options here, you'll have another chance to send out notifications and generate a report when ending the campaign.
-If you want to use a Slack channel for communication about this campaign, click **Add Slack channel**. Enter a Slack channel name, either an existing channel in your workspace or the name for a new channel you want to create.
+If you want to use a Slack channel for communication about this campaign, click **Add Slack channel**. Enter a Slack channel name, either an existing channel in your workspace or the name for a new channel you want to create.
- When a new campaign made from this template starts, all campaign owners and users assigned access reviews will be automatically added to this channel.
+ When a new campaign made from this template starts, all campaign owners and users assigned access reviews will be automatically added to this channel.
When new campaign instances are created from this template, you'll have a chance to change the Slack channel before starting the campaign.
- **Sending campaign notifications to a private Slack channel?** Make sure the [ConductorOne Slack app](/product/admin/slack-application) is added to the channel before you confiugre it here, or the notifications won't be delivered.
+ **Sending campaign notifications to a private Slack channel?** Make sure the [ConductorOne Slack app](/product/admin/slack-application) is added to the channel before you configure it here, or the notifications won't be delivered.
-### Step 3: Choose what to review
-
-Next, build a list of the resources that campaigns made from this template will review.
-
-
-
-On the **Scope** tab of your template, find the **Apps and resources** section of the page and click **Make selections**.
-
- - To run a UAR on user access to specific permissions, click **Review specific resources** and select resources, then click **Save**.
-
- **OR**
-
- - To run a UAR on user access to applications, click **Review application access** and select apps, then click **Save**.
-
- **OR**
-
- - To run a UAR on all of the resources of a given resource type within a specific app (such as all the groups within Google Workspace), click **Review resources by type** and select the resource types for each applicable application, then click **Save**.
-
-
- **You cannot mix selections from the three tabs in a single campaign.**
-
- If you want to review both application access and non-access resources in a single campaign, select **Review specific resources** or **Review resources by type** and add the **Credential** resource type to the campaign.
-
-
-
-If you're building a UAR reviewing specific resources, click **Edit scope** to remove entitlements from the review or update the policy used to review specific entitlements. Click **Apply changes** when you're finished.
-
-
- 
-
-
-
-If you're building a UAR reviewing specific resources, click **Edit scope** to remove entitlements from the review or update the policy used to review specific entitlements. Click **Apply changes** when you're finished.
-
-
- 
-
-
-
-**Optional.** Find the **User selection** section of the page and click **Make selections**.
-
- If you don't make any selections here, all users with access to the apps or resources you selected above will be added to the campaign. If you want to narrow the focus of the UAR:
-
- - Click **Select specific users** to build a list of users whose access will be reviewed, then click **Save**.
-
- **OR**
-
- - Click **Select users by criteria** to review users who match the criteria you set, then click **Save**.
-
- You can mix and match these options:
-
- - User status in ConductorOne
-
- - Direct reports of a manager
-
- - [User profile attributes](/product/admin/attributes). For example, to run an access review campaign on all the AcmeApp users in your company with the job title "Engineer", create the parameter **User AcmeJob is Engineer**.
-
-
-**Optional.** Find the **Account parameters** section of the page and click **Make selections**.
-
- If you don't make any selections here, all accounts with access to the apps or resources you selected above will be added to the campaign. If you want to narrow the focus of the UAR:
-
- - Click **Select accounts by criteria** to review app accounts that match the criteria you set, then click **Save**.
-
- You can mix and match these options:
-
- - No account owner
-
- - Account status
-
- - Account type
-
- - Account domain (specifically, whether the email address associated with the account has been [marked trusted](/product/admin/global-settings#set-trusted-domains) by a C1 admin at your organization)
-
-
-
-**Optional.** Find the **Grant parameters** section of the page and click **Make selections**.
-
- If you don't make any selections here, all access grants of the apps or resources you selected above will be added to the campaign. If you want to narrow the focus of the UAR:
-
- - Click **Select grants by criteria** to review only the access grants that match the criteria you set, then click **Save**.
-
- You can mix and match these options:
-
- - New grants added within the time period you select or between two specific dates
-
- - Temporary (time-limited) or permanent grants
-
- - Grants that have not been used in the time period you select (this information is not available for all applications)
-
- - Direct grants (permissions assigned directly to users) or inherited grants (permissions assigned to a group or role, which are "inherited" by users assigned to that group or role)
-
- - Grants sourced from access profiles (check the box to exclude these grants from your campaign)
-
-
-A summary of your choices is shown on the **Scope** tab. Click **Validate scope** at any time to generate a report showing a preview of a campaign made from the template based on the current scope.
-
-Once you're satisfied with your selections, move on to the next step.
-
### Step 4: Review and start a campaign created from a template
-When a new campaign is created from the template, it is shown on the template's **Campaigns** tab and also added to the **Drafts** tab.
+When a new campaign is created from the template, it is shown on the template's **Campaigns** tab and also added to the **Drafts** tab.
-Edit the campaign as needed, then follow Steps 3 through 5 in [Create a new campaign](/product/admin/campaigns#create-a-new-campaign) to review current data accuracy, prepare the campaign, and start the campaign (if necessary).
+Edit the campaign as needed, then follow Steps 4 through 6 in [Create a new campaign](/product/admin/campaigns#create-a-new-campaign) to review current data accuracy, prepare the campaign, and start the campaign (if necessary).
-## Frequently asked questions about creating campaigns
+## Frequently asked questions about creating campaigns
In short, nothing. If you select a resource for your campaign that does not have any grants on any of its entitlements, no review tasks will be created for the resource, as there is nothing to review. You can add these resources to your campaign without impact, or leave them out: it's up to you.
-Yes, you can! Go to the running campaign's **Configuration** tab and add or edit the campaign instructions. Reviewers will see the new version of the instructions as soon as you click **Save**.
+Yes, you can! Go to the running campaign's **Configuration** tab and add or edit the campaign instructions. Reviewers will see the new version of the instructions as soon as you click **Save**.
+
+
+No. The scope type you choose when creating a campaign cannot be changed afterward. If you need a different scope type, create a new campaign.
+
+
+If you scope a campaign by **All** conflict monitors, the campaign includes all violations from every enabled monitor at the time the campaign is prepared. Monitors enabled after the campaign is prepared are not included. To include new monitors, create a new campaign.
-