Why it matters
Certifications exist because access drifts. People change roles. Projects end. Temporary privileges become permanent. A scheduled review forces accountability and creates an audit trail that access was examined.
The quality of a certification depends entirely on the quality of the data. If reviewers see stale CSVs, missing local accounts, or entitlements that no longer match the application, they are certifying a picture of the past. Decisions made on incomplete inventories leave real access untouched.
Revocation is the second half of the control. A "reject" that never becomes a verified disable in the application is paperwork, not risk reduction.
Example
During a quarterly review, a manager rejects a former contractor's role in a vendor portal. The IGA records the decision. Because the portal has no connector, nobody disables the local account until the next campaign. The certification closed. The access remained.
How it is typically handled (and where it breaks)
IGA platforms run campaigns well for connected apps. For disconnected apps, teams export user lists, paste them into review tools or spreadsheets, and chase owners over email. After decisions are collected, someone still has to execute revokes by hand.
That workflow is expensive and late. It also discourages onboarding more apps into the review scope.
How Redblock handles it
Redblock helps in two places. First, account and entitlement aggregation from disconnected apps feeds fresher data into governance reviews. Second, when a certification rejects access, Redblock can execute the revoke inside the application and confirm the result, closing the loop between decision and enforcement.
See the expedite UAR with Redblock datasheet and identity governance overview.
Certifications are also a human process. Reviewers rubber-stamp when the campaign is too large, the data is confusing, or the business impact of a revoke is unclear. Better campaigns scope by risk, present clear entitlement language, and make revoke execution automatic once a decision is recorded.
Auditors increasingly ask not only whether a review occurred, but whether rejected access was actually removed. Closing that revoke loop matters most for disconnected apps, where there is no connector waiting to process the IGA reject decision.
Some organizations shorten campaigns by excluding disconnected apps. That improves completion rates and weakens the control. Others include those apps with manual data and accept the operational cost. Neither option is satisfying at scale.
Related terms
- Identity Governance and Administration (IGA)
- Deprovisioning
- Account Aggregation
- Orphaned Accounts
- Joiner-Mover-Leaver (JML)
Frequently Asked Questions
How often should access be certified?
Cadence depends on risk and regulation. Many enterprises review high-risk apps quarterly and broader populations annually. The right answer is the one your policy and auditors require.
What makes an access certification effective?
Current account data, clear reviewers, timely decisions, and verified revocation when access is rejected.
How does Redblock support certification campaigns?
By aggregating access from apps outside standard connectors and by executing certification-driven revokes with verification evidence.