FAQ: Access Certification

This article answers questions about Access Certification behavior that is easy to miss. For setup and day-to-day use, see Manage Access Certification and Users: Access Certification Campaigns to learn more.

Getting Started

What do I need in place before I can create a campaign?

Check the following before you create your first campaign:

• Access Certification is turned on. Go to Configuration and make sure Enable Access certification is on.
• You have an admin role with Full Access to Access Certification.
• For an application access campaign, the SSO application has at least one user group with access to it. For a user group membership campaign, the user group exists.
• Every reviewer has a work email on their user record. Review emails are sent only to that address.

Which admins can manage campaigns?

Access Certification is a permission scope in Custom Roles, with three levels:

• Full Access: Create, edit, extend, end and delete campaigns, act as an Administrator reviewer, record decisions, sign off reports and manage Configuration.
• View: See campaigns and download reports. View admins can’t change campaigns, record decisions or sign off reports.
• No Access: Access Certification is hidden.

The Administrator role has Full Access. Administrators with Billing Only and Help Desk roles have No Access. Custom roles that existed before Access Certification release have No Access until an admin who manages custom roles grants it.

Can I turn off Access Certification while campaigns are running?

No. End all active campaigns first, then turn off Enable Access certification in Configuration.
While Access Certification is off, scheduled campaigns are set to Disabled and don’t run, campaigns and reports can’t be opened, and no emails are sent. Download any reports you need before you turn it off. When you again turn it on, scheduled campaigns stay Disabled until you reactivate them.

Campaigns and scheduling

What are the scheduling limits?

• The earliest start time is 30 minutes from now, in your local time zone.
• The review window can last from 1 to 180 calendar days. The default is 30 days.
• A custom remediation date must be after the review phase closes. For a recurring campaign, it must also be at least 1 day before the next run.
• You can extend an active campaign or end it early.

Are users who gain access after a campaign has started included?

No. When a campaign starts, JumpCloud takes a snapshot of the users in scope, and only those users are reviewed. Users who get access later are included in the next run of a recurring campaign, or in a new campaign you start. Users who lose access during the campaign stay in the list until the campaign closes.

Do recurring campaigns reuse the same list of users?

No. Each run takes its own snapshot when it starts. Changes you make to a scheduled campaign apply only to future runs. Closed runs keep the configuration and results they had.

Does starting a recurring campaign early change its next run date?

No. Start campaign runs the campaign immediately, and the next scheduled run will occur on its initially scheduled date.

Where does a one-time campaign go after it finishes?

Its configuration returns to the Scheduled tab as Inactive, and its results are in the Closed tab. The Scheduled tab shows only Enabled campaigns by default. Remove the Status filter to see Inactive campaigns.

If I delete a scheduled campaign, are its past results deleted too?

No. Deleting a campaign from the Scheduled tab removes its configuration only. Its closed runs and reports stay in the Closed tab.

Reviewers

Can a reviewer review their own access?

No. Reviewers are never asked to review their own access. In a user group step, the item is unavailable only to that member, and the other members of the group can still review it. For other reviewer types, when the reviewer for an item would be the user being reviewed, the item goes to administrators instead. An admin can then either decide on the item, which completes the review for that user with no further reviewers, or reassign it to another reviewer, who can’t be the user being reviewed.

When are reviewers notified?

Reviewers receive emails at their work email:

• When items are first assigned to them (one email for all their items).
• When items are reassigned to them.
• At the midpoint of the review window, only if the window is longer than 5 days.
• When 1 day remains.
• When the review phase ends, and if the campaign is canceled.

Without reassignments, a reviewer receives up to three review emails per campaign. Email is the only channel, the templates can’t be customized, and reviewers can’t turn these emails off.

Can a reviewer change a decision after submitting it?

No. A submitted decision moves to the next reviewer, or completes the review, immediately. An admin can override the decision, but only before its remediation has run. The override is recorded as a separate entry with the admin’s justification, and the original decision stays in the audit trail.

Remediation

Does Revoke option remove the account inside the application?

Not necessarily. Remediation acts in JumpCloud: depending on the campaign’s remediation settings, a Revoke removes the user from the user group or, in user group membership campaigns, suspends the identity. Whether the user’s account inside the application is also removed or deactivated depends on how the application is connected and automated, for example user provisioning (SCIM) configured for the application, a workflow that calls the application’s API to deprovision the user, or another automation outside JumpCloud. If none of these is in place, JumpCloud doesn’t remove or deactivate the account in the application, and you need to do it in the application.

Who carries out the remediation?

JumpCloud does, as System, not the admin or reviewer who made the decision. A Revoke recorded by a Full Access admin removes the access even if that admin can’t edit the user group elsewhere in JumpCloud. The audit trail records both who decided and that System carried out the change.

Can a remediation be undone?

No. If a remediation removes access that the user still needs, grant the access again manually. Ending a campaign with End review and cancel remediation only stops remediations that haven’t run yet.

Reports and evidence

What is a report sign-off? can it be undone?

Sign-off is an admin’s formal confirmation that a closed campaign’s results are complete and accurate. It gives auditors an accountable person for the review, alongside the decisions themselves. Sign-off is your organization’s attestation, not a certification by JumpCloud.
The first admin with Full Access who selects Download & Sign off for the PDF becomes the certifying admin. Their name and the sign-off time are added to the report, and the report is regenerated with a new document hash, which replaces the previous one.
Sign-off can’t be undone, transferred or repeated. If you only need a copy of the report, select Download, and sign-off stays Pending.

How can an auditor verify that the report hasn’t been altered?

Every report has a SHA-256 document hash. To check whether a downloaded report is exactly what JumpCloud produced, see Verify the Integrity of an Access Certification Audit Report to learn more.

Does Access Certification make my organization compliant with SOX, SOC 2, ISO 27001 or HIPAA?

No. Access Certification helps you run access reviews and keep a record of them, which can support some of the access review requirements in these frameworks. The campaign results, decisions and sign-off are your organization’s attestations, not certifications issued by JumpCloud. Whether your organization meets a standard is determined by your own controls and your auditors.

Do I need to keep my own copy of the audit evidence?

Yes. Directory Insights keeps events for 90 days. The campaign report is generated when the campaign closes so the evidence of the review isn’t lost when those events expire. You’re responsible for keeping your own audit evidence: download the reports (PDF, CSV and JSON) and any Directory Insights events you need, and store them according to your audit and retention requirements.