Access reviews¶

An access review asks the people who know a group (its owner, or operators you choose) to confirm who should still be in it. At the end, the console removes the members they marked for removal, through the same checks as a manual removal. Typical use: a quarterly review of the client's file-share and application groups by their owners, as evidence for an audit.

Who does what¶

Role	Needs	Can
Campaign administrator	the application permission `accessreviews.manage` (Super administrator has it)	launch campaigns; follow, close, cancel and export the campaigns they launched (a Super administrator: every campaign) (Access reviews in the menu)
Reviewer	nothing besides signing in to the console	see and decide the memberships of the groups they review (My reviews)
Closing administrator	`accessreviews.manage` and the right to remove members of each group (`groups.members.write`, or `groups.owned.members.write` on a group they manage)	execute the removals at close

A reviewer is either:

an operator named on the campaign: they review every group of the campaign;
the owner of a group, when the campaign asks the owners: the account set as the group's manager (managedBy), read fresh from AD each time (if the manager changes during the campaign, the new manager reviews it). The owner must sign in to the console with that AD account (a Teleport operator is matched through their AD names, see Security model).

Nobody reviews their own membership: such a row is shown read-only and any attempt is refused and audited (self_review).

Launching a campaign¶

Access reviews > New campaign: name, description, due date (at most 366 days), groups, and reviewers (group owners and/or named operators, at most 100; at least one of the two).

Only groups you may read (groups.read) can be added; another group is refused as if it did not exist.
The direct user members you may read are copied into the campaign (snapshot). Members you may not read (out of your scope, privileged accounts, computers, nested groups) are left out and counted as hidden on each group. At most 2,000 members per group and 200 groups per campaign.
The launch is audited (accessreviews.create) and sends a first reminder (access_review_reminder).

Reviewing¶

My reviews lists the open campaigns where you review at least one group, with what is left to do. For each member choose Keep or Remove, with an optional comment (at most 500 characters, single line). You can change your mind until the campaign is closed. Each decision is audited (accessreviews.decide, on the group, with the member).

Reminders and overdue campaigns¶

While memberships wait for a decision, the console sends access_review_reminder every 3 days (AccessReviews:ReminderEvery), naming the reviewers. Once the due date has passed and the campaign is still open, it sends access_review_overdue once a day (AccessReviews:OverdueEvery). These go to the notification channels subscribed to them (Configuration > Notifications): point them at a channel the reviewers or their managers read. The last send is stored with the campaign, so a restart does not repeat it.

Closing¶

Preview (no change): each "remove" is decided now by the engine for you, the closing administrator, on fresh facts. A removal you may not make (out of your scope, privileged member, VIP without override, the member is you...) is shown with the reason.
Close: confirm your identity (step-up), confirm the removals and give a ticket if the instance requires one. Each removal goes through the same path as removing a member by hand (engine, write account, audit row groups.members.remove under the close's correlation id). A removal the engine refuses at that moment is reported as denied, never forced; a member who is already gone is reported as not_member. Memberships nobody decided are kept and reported as not_reviewed.
The close is audited (accessreviews.close, result succeeded, or partial when some removals were denied or failed) with the counts. A closed campaign cannot be closed again; Cancel ends an open campaign without executing anything (accessreviews.cancel).

Report¶

Export CSV (comma or semicolon) on a campaign: one row per membership with the group, its owner, the member, the decision, the comment, the reviewer, the date, and the outcome of the close. Every cell is quoted and formula injection is neutralised (a cell starting with =, +, -, @ gets a leading apostrophe). The export is audited (accessreviews.export).

Limits¶

The snapshot is taken at launch: someone added to a group afterwards is not part of the campaign (launch another one).
Removals happen at close, not when a reviewer clicks Remove.
A large campaign closes in one request; keep campaigns to a size you can review (a few thousand memberships).