Set up a multi-stage review
A multi-stage review sends approved access that matches a filter to a second reviewer, for example to re-review admin entitlements. You configure it per campaign in the wizard's Review process step, and each second-stage review starts only after an admin approves the first reviewer's account set. The setting is hidden for attestation-only campaigns.
Add the second stage
In the campaign wizard's Review process step, open the Multi-stage review card. It shows Using defaults until a stage is configured, and Customised afterwards.
Click Add second stage. The Second review panel opens with one blank rule.
In the rule, choose Resources (leave empty for any resource in the campaign), Entitlements (pick names, or add a pattern under
or name contains…), and the Reviewer who re-reviews what matches.Click Add rule to add more routes, and set the stage's Due field to the number of days after cycle start. The default is 7.
Rules match top to bottom and the first match claims the account, so Ploy moves a catch-all rule, one with no resources or entitlements selected, to the bottom automatically. Entitlement names match case-insensitively, and the name-contains pattern is a case-insensitive substring match.
What starts stage 2
Stage 2 starts per account set when an admin approves a first-stage account set, not when the reviewer submits it. Approving creates a new second-stage account set in the same review, assigned to the reviewer selected by the first matching rule. The set contains only kept accounts whose entitlements match that rule, and only the matched entitlement rows; a catch-all rule carries all kept entitlements. The review reopens as in progress until the second stage is done.
Accounts marked for removal, recorded as no response, removed from scope, or kept without a matching rule do not progress to stage 2.
If the configured second-stage reviewer holds the access themselves, the account goes to that person's manager instead, unless self-review is allowed.
Track and approve stage 2
The cycle detail page shows a Stage X of Y chip on each review row. Review details have one tab per stage, with the reviewers for each stage listed under it. The second-stage reviewer sees Re-review — stage X of N on their accounts, with a Previously reviewed disclosure showing the first reviewer's decision.
Second-stage submissions flow through the same Awaiting approval tab and admin approval step as first-stage sets; see Approve an access review. When a second-stage reviewer removes access, the removal is applied directly and removal remediation starts: it does not wait for another admin approval. In a decision-only campaign, the removal decision is recorded without creating remediation.
Completion
A review with second-stage work outstanding cannot complete until those account sets are submitted and approved. End Cycle is the exception: it completes the cycle without checking for outstanding second-stage sets. See Manage a running access review. For how reviewers are chosen in the first place, see Assign reviewers.