Skip to main content
Access Campaigns, Opal’s new interface for access reviews, is now GA! For current customers, this interface supports all features from the legacy Access Reviews. If you’re on the legacy feature and need help transitioning, please contact our support team.
Access Campaigns allows you to automate User Access Reviews (UARs) in Opal. Compliance teams can:
  • Snapshot user access when a campaign draft is created
  • Scope access campaigns intelligently with natural language or a query builder
  • Automatically assign reviews for managers, resource owners, approvers, or users themselves (self-review)
  • Send custom instructions and bulk reminders all without leaving Opal
  • Generate a report to summarize all actions for audit purposes

​
Requirements

You must have the Opal Auditor or Opal Admin role, or a custom Opal role with the Create permission for Access Reviews, and be on versions 1.1196.0 or later to view the new interface. To learn more about the roles in Opal, see our page on role capabilities.

​
Creating an Access Campaign

Navigate to the Access Campaigns tab and click + Access Campaign in the top right corner.

​
Scoping a Campaign

Define the scope of your campaign by using natural language input or adding a Principal, Asset, and/or Edge filter in the query builder. Scoping an access campaign with the query builder. The query you build will be run against your access graph to produce all access items that fulfill those criteria, much like an SQL query. Here are the filters you may use to scope your campaign: To condition principals, add a condition + Condition under From principals where. To condition assets, add a condition under To assets where. To condition on the edges between the principal and asset, add a condition under via access that is. Examples of queries you can build include:
To find all users Principal who have access to Github repositories Asset, you would select “Principal Type is User” and “Asset Item Type is Github Repo”. Then, to narrow it down only to admin access Edge to Github Repositories, add an edge condition “Role Name is Admin”.Picture showing how to scope down to all users who have github repo admin access. It shows principal type = users, asset item type = github repo, and role = Admin.If you want to scope it even further down to the specific Github repository, you would instead select Asset is [Github repository name].
To find all permanent Edge access to a specific Okta app like Figma Asset, you would select “Asset is Figma” under to Assets where, and edge condition “Permanent access only” under via access that is. The reason you would add the condition “Asset is” instead of “App is” is because Figma is not a native app in Opal; rather it is managed by the Okta app integration as can be seen in the dropdown.
To find all users Principal access to resources tagged uar:True Asset, you would first select “Principal Type is User” under From Principals where. Then, you would add the asset condition ALL OFF “Asset Type is Resource” and “Asset Tag is SOX:Eng”, with the Tag source being the place you tagged your resources (e.g. Opal, your HRIDP system). Conditioning the Asset with “Asset Type is Resource” ensures that you only scope in user -> resource relationships. If you have groups you’ve tagged that you want to scope in as well, remove the condition “Asset type is Resource” to include ALL asset types.
To find all groups Principal access to either Github Repository A or B Asset, you would first select “Principal Type is Group” under From Principals where to find all Group access. Then, you would add the asset condition ANY OF “Asset is Github Repository A” or “Asset is Github Repository B”. Switching the entity condition to ANY OF applies an OR condition to the two Entity conditions, allowing you to scope in groups that have access to either one or the other repositories. You may generalize this to specific assets (e.g. specific resources), asset item types (e.g. any Github Repositories OR Gitlab repositories), or apps (e.g. Okta apps).
For both Principals and Assets, you can also add Advanced Access Filters. These filters will allow you to further condition on the access principal or asset might have. Examples of queries you can build with this include:
  • All access that users who have access to Github Repo Admin have
To preview the results of the scope you’ve created, click Preview Scope. Opal displays a summary of the scoped users, groups, resources, and reviewers above the preview table, and saves a Scope Summary card on the campaign’s Overview tab after creation.

​
Set Reviewer Assignment Policy

Select a reviewer assignment policy from the dropdown. The preview table updates automatically to reflect your selection. Selecting a reviewer assignment policy with the preview table. Available assignment policies include:
  • Entity Admins (round robin): Assigns each item across the admin owners of the asset.
  • Entity Admins (all): Assigns each item to all admin owners of the asset.
  • User’s Manager: Assigns each item to the principal user’s manager.
  • Entity Approvers (round robin): Assigns each item to one user from each of the asset’s configured request approver owners, in round-robin order.
  • Entity Approvers (all): Assigns each item to all configured request approvers for the asset.
  • Self Review: Assigns each user to review their own access directly.
  • Manual: Leaves reviewer assignments blank when creating the draft so you can assign them manually.
You can’t change the bulk assignment policy after you create the campaign, but you can make manual adjustments to individual reviewers after saving your draft. Turn on Allow self-review to let users review their own access when another policy (such as User’s Manager or Entity Admins) would otherwise exclude them. You can change this setting after creating the draft.

​
Configure your draft

After you click Create, your access campaign enters Draft mode. This allows you to edit reviewer assignments, add general information, and configure specific controls before you launch it to your reviewers.
When you click Create, Opal takes a snapshot of the access relationships between principals and assets in your campaign. Any access changes that occur after this point won’t be reflected in the campaign.For example, if Jane’s GitHub role changes from admin to read-only after you click Create, the campaign will still show her original admin role.

​
Reviewer Assignment

Open the Reviews tab to manually edit reviewer assignments. Use multi-select, grouping, filtering, and sorting to bulk-assign reviews to one or more reviewers. Group your reviews by principal, asset or reviewer. You can also bulk assign reviews to each user’s relative manager or asset owner. If a review is assigned to multiple reviewers, it is only accepted if all reviewers approve access. If any reviewer revokes access, then the review item is revoked.

​
Settings

​
Set your deadline

Configure the deadline of your access campaign in the Settings tab. This is required before starting the campaign.

​
General

All notifications are sent through channels set up in Opal’s global configuration. You may configure Slack or email notifications via Configuration > Settings > Notifications. Learn more. Turn on Notify on new review to send reviewers a notification when they have new items to review, and include a custom message to be sent at the start of the campaign. Turn on Show tags to reviewers if you want reviewers to have visibility into user, resource and group tags to make their decisions. Turn on Stop when all items are reviewed to automatically transition the campaign from Ongoing to Stopped as soon as every review item has a decision, and notify Opal Admins, Auditors, and the campaign creator.

​
AI features

Use Generate and show Paladin insights to choose whether Paladin suggests bulk decisions for this campaign, and who sees them: Admins and Reviewers, Admins only, or Off. This section appears only when Access Review Insights is turned on for your organization. Learn more. The AI features section of campaign settings, with the Generate and show Paladin insights dropdown open.

​
Revocation

Choose when you want revocations to propagate to the end system:
  • When campaign ends: Revocations propagate only when an admin clicks End Campaign.
  • On decision: Revocations propagate immediately when a reviewer submits their decision.
  • Never: Decisions are recorded for audit reporting only; access is never automatically revoked from the end system.
Enable Require reason on denial to require reviewers to provide a comment explaining why access was revoked. Choose if you’d like to allow reviewers to reassign their reviews, and select who they can reassign them to.

​
Reminders

Choose a set schedule to send preset access campaign reminders to all reviewers with incomplete reviews. You may choose to include the reviewer’s manager in these reminders as well.

​
Start your campaign

When you’re ready to start your access campaign, click the Start Campaign button. You can also schedule your access campaign to start at a later date or recur on a schedule from the Scheduled tab:
  • Use template variables ({quarter}, {month}, {year}) in the schedule name to automatically populate each generated campaign’s name.
  • Toggle Auto start (enabled by default) to control whether campaigns created by the schedule start automatically or remain in Draft status until started manually.
  • Click Create campaign on a schedule at any time to immediately create a campaign from that template without waiting for the next scheduled run.
Only Draft campaigns can be deleted. Once a campaign has been started, stopped, or ended, it cannot be deleted so that audit history is preserved.

​
See also

This wraps up access campaign creation. See the links below for an end user guide to reviews or managing the campaign you just created.
Last modified on October 27, 2026