Article 3: Creating a Campaign

Before you start

Before creating a campaign, it helps to have a clear answer to three questions:

1. What access are you reviewing? (Which apps, which employees, which access attributes)

2. Who will review it? (Managers, resource owners, a specific team — and a fallback if they're unavailable)

3. What can reviewers decide? (The outcome options you want to offer: appropriate, not appropriate, out of scope, etc.)

You'll configure all of this inside the campaign creation wizard in the Ploy admin dashboard.

Step 1: Basics

Navigate to Access Reviews in the admin dashboard and click New Campaign. You'll be asked for:

• Campaign name — choose something descriptive that will make sense in six months (e.g. "Quarterly admin access — cloud infrastructure" rather than just "Q1 review")

• Description — optional, but useful context for other admins and for auditors reading the record

• Review type — choose Recurring (for ongoing campaigns) or One-off (for a single run). See Article 2: Campaigns vs. One-Off Reviews for guidance on which to use.

• Frequency — if recurring: weekly, biweekly, monthly, bimonthly, quarterly, semi-annual, or annual

• Due date / due days — how many days after a cycle starts before reviews are due. This sets the deadline for reviewers.

• Remediation window — how many days after approval a remediation action must be completed. This is separate from the review due date.

Step 2: Scope (filters)

This is where you define which access the campaign will review. Ploy uses three categories of filters — resource, employee, and access — which you can combine to precisely target what matters.

See Article 4: Configuring Review Scope & Filters for a full breakdown of every filter option and how they combine. A quick summary:

• Resource filters — target specific apps, integration types, or resource tags

• Employee filters — target employees by department, job title, manager, location, or status

• Access filters — target by usage patterns, MFA status, access age, or entitlement type

Ploy shows you a live preview of matching resources and accounts as you build your filters, so you can validate scope before saving.

Step 3: Reviewer assignment

This is where you define who reviews the access. You'll select or create an assignment configuration, which defines:

• The primary reviewer strategy (see Article 5: Assigning Reviewers)

• Any per-resource overrides (e.g. always route Salesforce reviews to the Sales Ops manager)

• Fallback reviewers for cases where the primary reviewer is unavailable

Step 4: Outcome options

This is where you define what decisions reviewers can make. You create a set of outcome options — each with a name and an associated action. Ploy has a set of standard outcome types you map your options to:

• Appropriate / Compliant / Required — access is correct, no action needed

• Not Appropriate / Non-Compliant / Not Required — access should be removed

• Out of Scope — this account isn't relevant to this review

• Adjust Entitlements — the account is correct but the specific permissions need changing

For each "remove" or "adjust" outcome, you can configure the automated action Ploy will take:

• Deprovision — automatically revoke access through Ploy's provisioning integrations

• Adjust Entitlements — create a manual task for the relevant team to update permissions

• Mark as Removed — record that access has already been removed manually

You can have multiple outcome options in a single campaign (e.g. "Appropriate", "Should be removed", "Needs entitlement adjustment", "Not applicable to this review").

Step 5: Cycle templates

Here you define the title and description that will appear on each cycle when it's auto-generated. Ploy supports variable injection so cycle names can include the date, cycle number, or campaign name automatically (e.g. "Q2 2026 — Admin Access Review — Cycle 3").

Step 6: Review and save

The final step shows a summary of your campaign configuration. Review it carefully — particularly the scope preview — before saving.

Once saved, the campaign appears in your Campaigns list. If it's a recurring campaign, Ploy will generate the first cycle on the scheduled date. You can also manually trigger the first cycle from the campaign detail page.

After creation

Once a campaign is live:

• You can edit the campaign settings (changes apply to future cycles, not the current running cycle)

• You can manually trigger a new cycle at any time from the campaign detail page

• You can archive a campaign to stop future cycles being generated

• All past cycles and their records are preserved regardless of campaign status