Campaigns vs. one-off reviews
Two ways to run a review
Ploy runs access reviews two ways: campaigns, which repeat on a schedule, and one-off reviews, which run once. Both use the same underlying review process, described in What is an access review?. The only structural difference is whether the review repeats automatically or runs a single time.
Where you create each one
Both are created from the Access Reviews page, which has a Campaigns view and a Simple reviews view. The button you use decides what you get.
Campaigns view: click Create campaign to open the campaign builder. Choose Recurring Campaign with a cycle frequency, or Ad-Hoc Campaign, which creates the campaign with no automatic scheduling so you run cycles manually.
Simple reviews view: click Create review to review a single application once, with no frequency. Ploy creates the campaign around it for you using your standard settings.
The Simple reviews view appears once you turn on the Enable simple reviews setting on the Access Reviews page.
The Review type choice
When you create a campaign or a one-off review, you also choose a Review type: Review each user in Ploy (the default), Attestation only, or Entitlement only. What each type changes is covered in Types of access review.
How campaign cycles repeat
A recurring campaign generates a new cycle on your chosen cadence: weekly, biweekly, monthly, every 2 months, quarterly, biannually, or annually. Each cycle applies the campaign's scope filters at generation time, so it reflects the access that exists when it starts; once a cycle is running, it keeps the scope it was generated with. Past cycles stay on the campaign as a record, grouped as active and completed cycles. The full lifecycle is covered in How review cycles work.
You can pause a campaign at any time with the Active/Inactive toggle on the campaign page, and switch it back on later.
Campaigns can carry tags, such as PCI, SOC, or ISO, which you can use to filter the Campaigns list and download all certificates for a tag in one go. Setting up a campaign end to end is covered in Create an access review campaign.
What stays the same
Once a cycle is running, campaigns and one-off reviews work the same way: the same scope filters, reviewer assignment, reviewer experience, approval flow, and evidence output. The campaign template is a blueprint; the cycle is the actual review.
When to use which
Use a recurring campaign when the same resources need certifying on a regular schedule, such as quarterly admin access reviews, or when you are building an ongoing access governance programme.
Use a one-off review for a point-in-time check: investigating a specific access concern, reviewing access for a team being restructured, piloting reviews before committing to a schedule, or responding to an auditor's request for a point-in-time certification.
Most teams that use Ploy for compliance run both: recurring campaigns for the standard certification programme, one-off reviews for ad-hoc checks. Start with one well-scoped recurring campaign for your highest-risk access, then add more campaigns as the programme grows.
Turning a one-off review into a campaign
You can edit a campaign after creation to add a frequency, which turns on automatic cycle generation going forward. The completed one-off cycle stays in the campaign's history.