Skip to main content

Troubleshooting: Access Certification

Use this article to resolve common Access Certification issues. Each issue lists the cause and how to resolve it. For how campaigns work, see Manage Access Certification.

Access is still active after a reviewer chose Revoke​

Cause: Remediation runs on the campaign’s remediation timeline, which you set when you create the campaign. Until it runs, the identity’s remediation shows Scheduled.

Resolution:

  1. Go to Access > Access Certification > Active and open the campaign.
  2. Find the identity and check Remediation action. Scheduled means the remediation hasn’t run yet.
  3. Select View configuration to see when remediation is set to run.

A remediation shows Failed​

Cause: JumpCloud couldn’t complete the remediation. When a remediation fails, JumpCloud automatically retries it within 1 hour. If it still can’t be completed, the remediation is marked Failed.

Resolution:

  1. Open the campaign and find the identity whose remediation shows Failed.
  2. Find the reason in Directory Insights: filter for the access_certification_remediation_action_executed event. Failed attempts show success: false and the reason.
  3. Fix the cause.
  4. In the campaign, select Retry next to Failed. JumpCloud tries the remediation again within 1 hour.

Retry is available until the campaign closes. After the campaign closes, the remediation stays Failed, and you need to remove the access manually.

A remediation fails for a dynamic user group​

Cause: For a dynamic user group, a Revoke removes the user by adding them to the group’s exclusion list, which holds up to 50 users. When the list is full, the user can’t be excluded. The campaign shows a banner, and a remediation task appears in Admin Tasks.

Resolution:

  1. Open the user group and go to its exclusion list. The group page shows “This group has reached its exemption limit”.
  2. Remove exclusions that are no longer needed, so there is a free slot for each Revoke in the campaign.
  3. Return to the campaign. Remediations that haven’t failed yet complete on their next retry. For remediations that show Failed, select Retry.

The banner and the Admin Tasks item clear once the group has enough free slots.

A finished one-time campaign isn’t in the Scheduled tab​

Cause: When a one-time campaign finishes, its configuration returns to the Scheduled tab as Inactive. The tab shows only Enabled campaigns by default.
Resolution: In the Scheduled tab, remove the Status filter. To go back to the default view, select Clear filter. The campaign’s results are in the Closed tab.

A campaign started with the wrong configuration​

Cause: The configuration of an active campaign can’t be edited.

Resolution:

  1. In the Active tab, select End campaign for the campaign, then End review and cancel remediation. No remediation runs, and the campaign closes as Canceled.
  2. Remediations that already ran before you ended the campaign aren’t reversed. Grant that access again manually if needed.
  3. In the Scheduled tab, edit or copy the campaign, correct the configuration and start it again.

Last accessed shows “No access record in the last 90 days”​

Cause: Last accessed comes from JumpCloud SSO sign-in events in Directory Insights, which keeps events for 90 days. The message means there is no JumpCloud SSO sign-in to the application by that user in the last 90 days. Sign-ins that don’t go through JumpCloud SSO aren’t counted.

Resolution: Treat the message as a signal, not as proof that the account is unused. If the application can be reached without JumpCloud SSO, check the application’s own sign-in records or ask the application owner before deciding.

The report hash doesn’t match​

Cause: The most common causes are:

  • A file other than the JSON file was hashed. Only the .json file matches the document hash. The PDF and CSV never match.
  • The file was downloaded before sign-off. Sign-off regenerates the report with a new hash.
  • The file was opened and saved in an editor, or saved from a browser’s formatted view.
  • The download was incomplete, or the file belongs to another campaign or another run of a recurring campaign.

Resolution: Download the JSON file again from the Closed tab and follow the instructions in Verify the Integrity of an Access Certification Audit Report.

I can’t turn off Access Certification​

Cause: Access Certification can be turned off only when there are no active campaigns.

Resolution: In the Active tab, end each campaign with End campaign, choosing whether to execute or cancel its pending remediations. Then turn off Enable Access certification in Configuration.

Before you contact JumpCloud Support​

If an issue persists, contact JumpCloud Support with:

  • The campaign name and campaign ID. The ID is part of the report file names, for example User-Exclusion_6ada2fde6c4c941707f441ec_audit.pdf.
  • The affected users, and the application or user group in scope.
  • The time the issue happened, in UTC.
  • The related Directory Insights events, exported or as screenshots.
  • Screenshots of the campaign and of any error or banner.

Was this information helpful?