<!-- Copyright (c) 2026 defconxt. All rights reserved. -->
<!-- Licensed under AGPL-3.0 — see LICENSE file for details. -->
---
name: performing-access-certification-campaigns
description: >-
  Plan and execute access certification campaigns that validate user entitlements are appropriate.
domain: cybersecurity
subdomain: identity-security
tags:
  - access-certification
  - entitlement-review
  - iga
  - access-governance
  - recertification
version: "1.0"
author: defconxt
license: AGPL-3.0
metadata:
  mitre-attack: ["T1078"]
---

# Performing Access Certification Campaigns

## Overview

Access certification campaigns periodically validate that user access rights
remain appropriate. Certification addresses privilege creep and satisfies
regulatory requirements (SOX, HIPAA, PCI-DSS) for access review.

## Prerequisites

| Requirement | Install |
|---|---|
| IGA platform | SailPoint, Saviynt, or equivalent |
| Identity provider | Azure AD, Okta, or AD |
| HR system integration | Current role and manager data |
| Python 3.10+ | For agent tooling |

## Key Concepts

### Campaign Types

| Type | Scope | Frequency |
|---|---|---|
| Manager certification | All reports' access | Quarterly |
| Application certification | All users of an app | Semi-annually |
| Role certification | Role membership review | Annually |
| Privileged access | Admin access | Monthly |
| SOD certification | Duty conflicts | Quarterly |

### Decision Workflow

1. Campaign created with scope, reviewers, and deadline
2. Review tasks assigned to managers or app owners
3. Reviewer certifies or revokes each entitlement
4. Non-response escalated or auto-revoked
5. Revocation enforced in identity provider
6. Audit evidence generated with timestamps

### Metrics

- **Completion rate** — Percentage completed by deadline
- **Revocation rate** — Percentage of entitlements revoked
- **Auto-revocation** — Entitlements revoked due to non-response
- **Cycle time** — Average time to complete review
- **Rubber-stamping** — >95% approval flags inadequate review

## Workflow

1. **Define campaign scope** — select users, applications, and entitlements
2. **Assign reviewers** — map managers and app owners to review tasks
3. **Configure deadlines** — set review period with escalation milestones
4. **Launch campaign** — send notifications and open review interface
5. **Monitor progress** — track completion rates and send reminders
6. **Enforce decisions** — revoke access for denied entitlements
7. **Generate evidence** — produce audit report with all decisions


## Detection

```yaml
title: Detect Access Review Override — Privilege Approved Outside Campaign Window
id: f8a9b0c1-d2e3-4567-fabc-678901234567
status: experimental
description: Detects privileged role assignments made outside of access certification campaign windows, bypassing the review process.
logsource:
  product: azure
  service: auditlogs
detection:
  selection:
    OperationName: 'Add member to role'
    TargetResources.modifiedProperties.displayName|contains: 'RoleDefinition'
  condition: selection
falsepositives:
  - Legitimate administrative activity from authorized accounts
level: medium
tags:
  - attack.t1078
  - attack.persistence
```

## Verification

| Check | Method |
|---|---|
| Campaign launched | Review tasks distributed to reviewers |
| Completion rate | Campaign completed with >90% response |
| Revocations enforced | Denied entitlements removed from provider |
| Escalations handled | Non-responsive reviewers escalated |
| Evidence generated | Audit report with timestamps and decisions |

## References

- [NIST SP 800-53 AC-2](https://csrc.nist.gov/)
- [SOX Section 404](https://www.sec.gov/)
- [IGA Best Practices — Gartner](https://www.gartner.com/)
- [ISO 27001 A.5.18](https://www.iso.org/standard/27001)
