Overview

This guide is for admins: anyone with the "Access Reviews – Take Action" scope. It covers configuring access review settings, launching campaigns, and tracking their progress. For an overview of the feature, see the main Access review article.

Access Review campaigns let you launch, group, and track access reviews across multiple applications in one structured process. Campaigns can be scheduled and set to recur, which suits compliance cycles such as quarterly audits.

Before You Start

• Fresh user data. Sync integrations or upload user files for the apps you plan to review.
• Reviewer permissions. To assign Torii members as reviewers, they need the "Access Reviews – Take Action" scope. App owners without Torii access can also be assigned.

• Configure which user fields should be available for reviewers, so that sensitive information is not accessible. See below. 

   

Configure Access Review Settings

By default, reviewers can add any user field as a column in the review table, including sensitive HR data such as manager, department, or termination date. You can limit which fields reviewers are allowed to see.

To choose which fields reviewers see:

1. Go to the Access Reviews page.
2. Open Access review settings.
3. Under Additional fields, select the fields reviewers are allowed to see. Use Select all or Clear all to adjust quickly.
4. Click Save.

Required fields are always visible to reviewers and can't be removed:

🔍 Note: These restrictions apply to reviewers only. Anyone with the Access Reviews – Take Action scope sees every field, even when they're assigned as a reviewer. Restricted fields are blocked by Torii, not just hidden in the interface.

Launch an Access Review Campaign

1. Go to the Access Reviews page.
2. Click Create campaign. This opens the campaign creation wizard.

Step 1: App Selection

Use filters to define which applications to include in the campaign. For example, you might filter for apps that are Sanctioned and have more than 10 users. A live preview of matching applications appears below the filter.

Step 2: User Scope Selection

Use filters to define which users will be reviewed for the selected apps. All users are selected by default, but you can narrow the scope:

• Users with privileged access: users whose role in the app contains "Admin" are included.
• Users that match specific filter criteria: use user filters to define the exact user segment.

App-specific user fields (such as role, license, status, or usage) appear in the user filters only after an App name filter is applied in Step 1. For example, if you select App name = Salesforce, you can filter users by Salesforce-specific attributes such as profiles or roles. Generic user fields (such as user type, past user status, or HiBob department) are always available.

Step 3: Review and Remediation Assignment

• Assign reviewers to the apps. Choose specific people, or use dynamic fields like App Owner to assign automatically based on app metadata.
• Assign remediation owners. They remove or downgrade access for users whose access was rejected during the review.

You can assign the same person to both roles or different people, depending on your organization's policy. In most cases, app owners act as reviewers and IT team members act as remediation owners.

Step 4: Schedule the Campaign

Choose whether to launch the campaign immediately or schedule it for a future date. Set the campaign duration to help track progress and deadlines.

You can mark the campaign as recurring, and Torii will relaunch it automatically on the schedule you define.

🔍 Note: For scheduled and recurring campaigns, the app filter is applied at launch, not at creation. For example, a recurring quarterly campaign that reviews sanctioned apps re-evaluates the list of sanctioned apps before each launch, so newly sanctioned apps are included. If no apps match when the campaign launches, that occurrence is skipped and moved to the Archived campaigns tab with a note that no apps matched.

Step 5: Create the Campaign

Click Create campaign.

• If you chose to launch immediately, access reviews are created for all matching apps and the campaign appears in the Active tab.
• If you scheduled it, the campaign appears in the Scheduled tab and launches automatically at the selected date and time.

✏️ You can edit or delete scheduled campaigns. Once a campaign becomes active, it's locked and can't be modified.

What Happens After Launch

Reviewers receive notifications for their assigned reviews by email, Slack, or Teams, based on your Task settings. They also receive automated reminders for incomplete reviews.

Monitor Progress

Use the Active, Scheduled, Completed, and Archived tabs to track campaigns through their lifecycle. Each campaign shows a completion summary: how many reviews are complete out of the total.

Click a campaign to see its details, including which app reviews have started, which are still pending, and which are complete. Use this view to follow up with reviewers when needed.

Cancel a Review

You can cancel a review from its campaign page. Cancelled reviews move to the Cancelled tab.

FAQs

Q: Can I prevent reviewers from seeing sensitive user data? A: Yes. Go to Access Reviews → Access review settings and choose which additional fields reviewers can see. Required fields are always visible. See Configure Access Review Settings above.

Q: Will Torii send reminders or escalations when the campaign deadline is getting close? A: Torii sends reminders based on the frequency configured in Task settings. The campaign deadline is currently used for monitoring only.

Q: Can I change a campaign after it launches? A: No. You can edit or delete scheduled campaigns, but active campaigns are locked. You can still cancel individual reviews.