Most engineers think…
Most people treat access certifications as an annual checkbox — a spreadsheet that managers rubber-stamp right before an audit. That mental model creates real risk and always surfaces in interviews.
SailPoint access certifications are a structured, trackable governance workflow: the platform generates campaigns, routes entitlement-level decisions to the right reviewers, records every approve/revoke with a timestamp, and triggers provisioning to actually remove revoked access. Add continuous certification and the review cycle becomes event-driven, not calendar-driven. Understanding those mechanics — not just 'we do annual reviews' — is what separates a confident IGA practitioner from a tick-the-box one.
① Why access certifications exist — and what they actually prove
Every identity accumulates access over time: a new project, a temporary system grant, a role given during onboarding that was never removed. Access certification (also called an access review) is the process that periodically forces a human — the right human — to look at each entitlement and say 'yes, still needed' or 'no, revoke it'.
In SailPoint IGA, certifications are not spreadsheets. They are structured campaigns with defined scope, designated reviewers, deadlines, escalation rules and a full audit trail. The output is not just a report — it is a set of provisioning actions that the platform executes to fulfil revocations. Auditors (SOX, HIPAA, ISO 27001) accept this trail as evidence that access is controlled.
The core value: certifications catch permission creep — the slow accumulation of access that no one deliberately granted but nobody removed either. Without them, over time almost every identity holds more access than it needs.
What problem do SailPoint access certifications primarily solve?
② The four campaign types — choosing the right scope
SailPoint IGA offers four campaign types, each scoping the review differently. Manager campaigns are the most common: every manager reviews the full set of entitlements held by their direct reports. This maps to the real-world question 'does my team still need this access?' and scales naturally with org structure.
Source owner campaigns flip the lens: instead of asking managers, the owner of a system (e.g. the Salesforce admin) reviews all identities that have access to that source. This is ideal for privileged or regulated systems where the source owner knows best who should be there.
Role and search campaigns
Role campaigns review membership in a role — useful when roles bundle many entitlements and you want to confirm who is legitimately in each role. Search campaigns are the most flexible: an administrator defines a custom filter (identities with a specific entitlement, in a department, on a risk score) and that cohort becomes the review scope. Use search campaigns for surgical, risk-based reviews outside the normal manager or source cycle.
The manager reviews all entitlements held by their direct reports. Most common campaign type — maps to real org structure and satisfies broad hygiene requirements.
The owner of a source (system admin) reviews all identities that have access to that source. Best for privileged or regulated systems where the admin knows who belongs.
Reviews membership in a SailPoint role. Useful when roles bundle many entitlements — confirm who is legitimately in each role before the next role-based provisioning cycle.
The most flexible type: an admin defines a filter (entitlement, department, risk score) and that cohort is reviewed. Use for surgical, risk-based reviews outside the standard manager or source cycle.
Manager campaigns work when the manager knows what their reports do day-to-day. Source owner campaigns work when the system admin knows who belongs on their platform. Never use a manager campaign to review a privileged system the manager has never logged into — that is rubber-stamping by design. Match the campaign scope to the person who genuinely knows the answer.
A security team wants to review all identities that hold a specific high-risk entitlement, regardless of department. Which campaign type fits best?
③ Reviewer workflow, decisions and revocation
Once a campaign is launched, SailPoint generates individual certification tasks for each reviewer. The reviewer sees a list of identities (or entitlements, depending on campaign type) and for each item makes one of three decisions: Approve (access is correct, keep it), Revoke (access should be removed), or Reassign (send this line to another reviewer for a second opinion or delegation).
SailPoint's AI recommendation layer presents a recommendation alongside each item. Studies of the platform show reviewers revoke access roughly twice as often when AI recommendations highlight risky or unused entitlements, reducing the rubber-stamp problem significantly.
From decision to revocation
When all reviewers sign off, the campaign either completes (all approved) or moves into a remediation phase. In remediation, every revoke decision generates a provisioning task — SailPoint sends the de-provisioning request to the source connector (Active Directory, Salesforce, AWS, etc.) and tracks fulfilment. Administrators can see open remediation items, chase overdue tickets, and confirm closure. The entire chain — reviewer decision, timestamp, provisioning action and confirmation — is stored for audit evidence.
A revoke decision moves the campaign into remediation and creates a provisioning task — but the entitlement is not removed until the source connector confirms it. If the connector is misconfigured or the ticket stalls, the identity keeps the access. Always monitor open remediation items and set an SLA on their closure. The audit evidence is complete only when the provisioning task is confirmed, not when the reviewer clicks.
▶ Watch a manager certification run end-to-end
Follow a single entitlement from campaign launch to revocation confirmed at the source. Press Play for the healthy path, then Break it to see the classic failure.
What does SailPoint do after a reviewer marks an access item as 'Revoke' and the campaign closes?
④ Continuous certification and design best practices
Continuous certification moves beyond fixed-schedule campaigns. Rather than waiting for the quarterly cycle, SailPoint monitors access-risk signals — a user changing roles, an entitlement being flagged as sensitive, a peer-group anomaly — and triggers a targeted review automatically. The reviewer is asked to recertify just the changed or risky access item, not a full entitlement list. This keeps governance real-time without reviewer fatigue from large annual campaigns.
Design best practices
Well-designed certification programmes share a few traits. Right reviewer, right scope: manager campaigns for broad hygiene, source-owner campaigns for privileged systems, search campaigns for risk spikes. Reasonable cadence: quarterly for most access, annual for low-risk, event-driven continuous for high-risk. AI recommendations on: always enable them — the data consistently shows higher revocation rates and fewer rubber stamps. Deadlines and escalation: set a firm deadline with an escalation to the reviewer's manager; campaigns without escalation stall. Remediation SLA: a revoke decision means nothing if the provisioning ticket sits open for 90 days — track and close every remediation item.
Priya at a Pune fintech runs into this
The quarterly manager certification campaign has a 15 % completion rate three days before the deadline, and the CISO is asking for audit evidence.
Managers are assigned 200+ entitlements each to review, there is no escalation rule set, and no reminder emails are configured — reviewers deprioritised the task.
Campaign dashboard shows most certifications are still 'In Progress'; reviewer workloads are far too large and the campaign has no escalation path.
Admin ▸ Certifications ▸ Active Campaigns ▸ Campaign Details ▸ Reviewer ProgressFor this cycle: manually escalate overdue certs to reviewer managers. Going forward: split large campaigns into source-scoped or search-scoped subsets, enable AI recommendations to cut decision time, set a deadline with auto-escalation to the reviewer's manager at day 5 of 7, and configure reminder notifications at day 3.
Next campaign: completion rate above 90 % by day 6; AI recommendations visible on each decision; escalation emails sent automatically on day 5.
A campaign showing 'Complete' does not guarantee all revocations are actioned. Open the remediation report for the campaign and confirm every revoke has a fulfilled provisioning task with a closed date. Auditors look at the remediation evidence, not the completion banner. This is the step most IGA teams skip and the one that gets flagged in audits.
Why does continuous certification reduce reviewer fatigue compared to a large annual campaign?
🤖 Ask the AI Tutor
Tap any question — instant, scoped to this lesson. No login, no waiting.
Pre-curated from vendor docs + community Q&A, scoped to this lesson. For a live prod issue, paste your export into chat.techclick.in.
📝 Wrap-up assessment — six more
You've answered 4 inline. Six left. 70% (7 of 10) marks the lesson complete on your profile. Tap Submit all answers at the end.
🧠 In your own words
Type one line: explain the difference between a campaign completing and the revocation being done. Then compare with the expert version.
🗣 Teach a friend
Best way to lock it in — explain it in one line to a teammate. Tap to generate a paste-ready summary.
📖 Glossary
- Access certification
- A structured review campaign in which designated reviewers confirm or revoke identities' entitlements; the output is a provisioning-backed audit trail.
- Manager campaign
- A certification type where each manager reviews all entitlements held by their direct reports, mapped to org hierarchy.
- Source owner campaign
- A certification type where the owner of a source (e.g. a system admin) reviews all identities with access to that source.
- Remediation phase
- The post-review stage of a campaign where revoke decisions are converted into provisioning tasks sent to source connectors to remove access.
- Continuous certification
- Event-driven certification triggered by risk signals (role change, peer anomaly, new sensitive entitlement) in real time, rather than on a fixed schedule.
- Permission creep
- The gradual accumulation of access rights over time that goes beyond what a user currently needs, addressed by regular certification campaigns.
- Provisioning task
- A tracked work item in SailPoint that carries a de-provisioning instruction to a source connector; the task must be confirmed fulfilled to complete the audit trail.
- AI recommendation
- SailPoint's AI-generated approve or revoke suggestion per entitlement, based on usage data, peer-group analysis and risk signals, shown to reviewers to reduce rubber-stamping.
📚 Sources
- SailPoint Documentation — Certifications Overview: campaigns, reviewer workflows and remediation. documentation.sailpoint.com/saas/help/certs/index.html
- SailPoint Documentation — Starting a Manager or Source Owner Campaign. documentation.sailpoint.com/saas/help/certs/starting_campaign.html
- SailPoint Documentation — Understanding Certifications: lifecycle, decisions and audit trail. documentation.sailpoint.com/saas/help/certs/understanding_certifications.html
- SailPoint Documentation — Completing a Certification Campaign: remediation and fulfilment. documentation.sailpoint.com/saas/help/certs/completing_campaigns.html
- SailPoint — Identity Governance and Administration: continuous certification and AI recommendations. sailpoint.com/identity-library/identity-governance
- SailPoint Developer Community — Certification Campaigns API (v2024). developer.sailpoint.com/idn/api/beta/certification-campaigns/
What's next?
Got certifications covered? Next, explore SailPoint role management and access request policies — how roles bundle entitlements, how requests are approved, and how separation-of-duty rules prevent toxic combinations.