Connect a source, collect, explore

01In a nutshell #sec_60b053e6

As long as no connection exists, no campaign can arm — it is the first setting of the subscription, before workspaces; and a green connection is only worth what it reports, which only Explorer shows.

02The three screens #sec_42688662

Data sources has three entries, and each answers a different question:

03Connections #sec_2828bb79

The systems where REVIEWIT collects the accesses to be reviewed. The page opens with a tile per solution in the catalog, and each tile says what REVIEWIT can do for it: probe available — the connection is proven on input — or Declarablle — the connection is supported; REVIEWIT does not yet know how to verify.

Connect

Connect a solution, then Connect an instance (or Declare an instance for a solution without a probe). The wizard asks for the tenant identifier and a first identifier: what REVIEWIT presents itself to the system with — client ID and secret or certificate — and the permissions it carries.

For a declarable solution, a checkbox commits: I confirm that this identifier has the declared rights. This connection will be active on this declaration, without verification by REVIEWIT. The connection is then valid by its declaration, and its health is displayed as Declared.

Read health

Each connection carries a health status — Verified, Failed, Never verified, Declared — and counts its identifiers: N identifiers out of N failed. An automatic check runs every 24 hours; Verify all connections launches it on demand, and Diagnose says what is missing.

The rule that counts is written at the top: a failed connection stops the collections of the workspaces that consume it — ongoing campaigns are not lost, they just stop updating. And the connection closes on its own:... has been automatically suspended: no identifier was responding anymore. The repair is done in your portal: the diagnosis will say exactly what to fix.

Identifiers

The Identifiers tab is the cross-sectional inventory — all identifiers, all solutions combined: solution, authentication mode, expiration, permissions, and for each one Verify this identifier, Remove, or Entrust the key for a certificate. An expiring secret is the most common cause of a stopped collection; this tab sorted by Expire is the list to reread every quarter.

Suspending a connection will deactivate the identifiers assigned to it and end any ongoing campaign; Disconnecting stops all workspaces defined in its scope. Read the impact before.

04Collect #sec_857224ee

Data collection — collect from connected sources or import reports, then follow each execution until its publication.

Two ways to launch: Collect from a connection, and Import a report — upload an exported report, validate its content, and publish it in the same data pipeline. And automatic collection plans: target, connection strategy, frequency.

The Required action block comes first when something blocks — a missing permission, an execution in validation — and names the action: View execution, Check permissions. Otherwise: No action required.

The work list of executions follows each pass — in queue, in progress, suspended, blocked, or in validation — and History keeps the published, rejected, failed, or canceled ones. Opening an execution gives its facts (Requested, Lines read, Elements published, Errors), its timeline, and its diagnostics and permissions: required versus granted.

The Data coverage and freshness block is the one to read: per target, Last successful snapshot, Freshness goal, and the status Up to date or To update. An armed campaign on a target to update certifies an already old state.

05Explorer #sec_f6cc7242

Explore the collected data to assess its quality, enrich missing information, report anomalies, validate responsible parties, exclude irrelevant elements, and prepare a reliable dataset for certification.

Two searches: by user (name, UPN, identifier, or email) and by resource (title, identifier, email). The results are bounded to stay fast; refine the query rather than scrolling.

On a resource: Detail, View certification history, Sanctuarize — the global exclusion, the one that workspaces see without being able to lift —, Add to a Watchlist. On a user: their resources, their accesses.

This is where the only thing that matters before a campaign is verified: does the collection report what the campaign will review? A verified connection that has not reported any object is seen here, and nowhere else.

06The rhythm #sec_1a537aca

07Key Takeaways #sec_fe568d49

Connecting proves that the door opens; collecting proves that one has passed through; exploring proves what has been brought back. A campaign is launched on the third, not on the first.