How review cycles work
What a cycle is
A cycle is one live run of an access review campaign. The campaign is the standing instruction ("review all admin access every quarter"); the cycle is a single instance of that instruction, with its own start date, due date, reviewers, and a snapshot of the access being reviewed.
Every cycle is numbered sequentially within its campaign (Cycle 1, Cycle 2, and so on), so you can track your review history over time. Reviews can run as recurring campaigns or as one-offs: see Campaigns vs. one-off reviews, and Types of access review for how the review types differ.
How a cycle starts
A recurring campaign generates its next cycle automatically when the campaign's next review date arrives. You can also start a cycle manually from the campaign page, which is useful for running an ad-hoc review or for starting a new campaign's first cycle immediately. For campaigns you build in advance, see Create an access review campaign.
At generation time, Ploy evaluates the campaign's filters against the current state of your SaaS estate. If people have joined, left, or changed roles since the last cycle, the new cycle reflects who has access right now. See Configuring review scope and filters for how filters shape what a cycle includes. You can also have workflows create access reviews when they come due: see Automatic access reviews.
For broad campaigns, previewing, creating, and launching processes resources in batches, so very large campaigns are less likely to fail.
What Ploy creates when a cycle is generated
Generating a cycle builds the full review structure in one step:
One review per resource. Every app or resource that matches the campaign filters gets its own review in the cycle.
Accounts within each review. For each resource, Ploy creates an account record for every employee whose access matches the filters. These are the individual access decisions reviewers make.
Entitlement snapshots. Ploy captures the entitlements each account holds at generation time. Snapshots are immutable: they record what access looked like when the review started, whatever happens later.
Member snapshots. Ploy also captures each member's details, such as department and job title, at the time the cycle is created, so reviewers and auditors see who the person was when the review ran.
Reviewer assignments. Accounts are grouped into account sets based on the campaign's reviewer assignment settings.
Luna analysis. Ploy runs Luna's analysis for each account set to produce recommendations for reviewers. See Luna recommendations in access reviews.
When the cycle opens, assigned reviewers are notified and work through their accounts in the employee portal. The reviewer side is covered in Complete a review: reviewer guide.
Review progress states
A review stays Not started until a reviewer opens it, then moves to In progress. Reassigning a review to entirely new reviewers resets its progress, so it returns to Not started until the new reviewers begin.
As decisions come in and are approved, reviews move through Ready for approval to Complete. The review list has a Not started filter, and Not started reviews sort first, so outstanding work is easy to spot.
Rescheduling the next cycle
For a recurring campaign, you can move the start date of the next cycle from the campaign page using the control beside Next Cycle. The reschedule options are This cycle only and This and future cycles, and the modal previews when the following cycle will start after your change. Reminders follow the new date.
Tracking a cycle
Open a cycle from its campaign to see progress on the cycle detail page. The header shows the cycle's status with completed and total review counts, the start and due dates, and the time remaining (or how overdue the cycle is).
Three summary cards sit at the top of the page:
Timeline: how much of the cycle's window has elapsed, with the due date.
Remediation: revocations from this cycle, split into In progress, Complete, and Failed.
Open queries: reviewer queries awaiting an admin response.
The reviews table lists each review in the cycle with its due date, stage, completion, status, reviewers, accounts, revocations, and evidence. Tabs on the page cover outcomes, activity, and reviewer queries.
From the cycle detail page you can also:
Send Reminders to reviewers who haven't completed their reviews for the cycle. Ploy reports how many reminders were actually sent, and shows "No reminders sent" when none were due.
Investigate with Luna to look at outstanding reviews, reviewers, and the due date with Luna's help.
Add Resources while the cycle is in progress.
End Cycle, available for any cycle that isn't complete yet.
For the notification and reminder settings behind these actions, see Access review notifications and reminders.
Finding accounts in a review
Search within a review matches an account's identity login, external identifier, and display name, including service accounts.
When a cycle completes
A cycle completes when every review in it has been approved. Ploy then generates compliance certificates, and the cycle's decisions, notes, attestation, and certificates are kept as your audit record. See Approve an access review for the approval flow, and Review evidence and compliance certificates for what a completed review produces.
If the campaign is recurring, Ploy schedules the next cycle based on the campaign's frequency. Remediation for access marked as inappropriate is covered in Review outcomes and remediation.