The end-to-end cycle of a campaign
01In a nutshell #sec_b8b4c57e
A campaign goes from an intention — “I want to certify this” — to an admissible proof, through human decisions that no automation can replace.
02Collection, before anything else #sec_756f1a3f
Nothing can be certified without data. The subscription administrator connects to the source — a Microsoft 365 tenant, for example — and the collection records the real state: the groups and their members, the spaces and their owners, the last activity dates, the shares.
This collection is not a single snapshot. It is replayed, and this is what allows us to say that an access is still there at the time of certification, and not that it was there six months ago.
03The intention: what, and according to which rule #sec_a537ce1e
The workspace administrator opens Campaigns › New campaign. The first screen asks the only question that governs everything else: what do you want to certify?
They choose a technical scope — a solution, a workload, a resource — then a policy. Five families:
| Policy | What it questions |
|---|---|
| Inactivity | Dormant accesses: still used, or to be removed? |
| Membership | Who has access to what, and is it still justified? |
| Ownership | Who is responsible for this resource? |
| Permissions | Are the granted rights at the right level? |
| Privacy | Is the visibility of this resource what we think it is? |
The choice of policy is not cosmetic: it determines the criteria that the reviewer will see, the form of their decision, and the eligible reviewers.
04The rest of the configuration #sec_f69bcd11
The wizard has seven steps, and it refuses to move forward until the previous one is complete.
- Intention — the technical scope and the policy
- Identity — the name of the campaign, what it will be recognized by in six months
- Scope — what is exactly included, and what is excluded
- Reviewers — who decides: the manager, the resource owner, a named list
- Cadence & communication — the deadline, reminders, messages
- Certification rules — what counts as a decision, and what blocks
- Review & launch — the review before arming
The last screen deserves its name: once launched, a campaign produces requests, and a request is addressed to someone.
05The decisions #sec_1cf93f85
Each designated reviewer receives their queue in the REVIEW Center. For each resource, the screen states three things, distinctly:
- The criterion — what the policy expects
- The observed — what the collection has recorded
- The decision — what the reviewer attests
A decision requires a written justification. It is not a decorative field: it is what, in a year, will explain to an auditor why this access was maintained.
06What happens when no one decides #sec_a9a76277
A campaign does not wait indefinitely. The workspace administrator sees its delays in Steering and in the Alert Center, reminds, redistributes, delegates.
What they cannot do is decide in place. A campaign that ends with requests without a decision ends like this, and the report says so.
07The proof #sec_0e5b28dd
At closure, what remains is not a dashboard: it is a certification file. Who decided what, when, on what basis, and with what justification.
The audit trail that carries it is append-only: it is written, it is not rewritten. This is what distinguishes proof from a report.
08And after #sec_0de1c4d8
A recertification is not a project, it is a rhythm. One closed campaign calls for the next, and the value of the product lies less in the first campaign than in the tenth — when comparison between two passages becomes possible.
09To remember #sec_fac9e6a3
Collect, choose a rule, designate who responds, let decide, prove. Five steps, and only one is automatable — the first.