Skip to main content

Frequently asked questions about Access Recertification

This page covers common questions regarding the cidaas Recertification Review Center (/customer-portals/recertification), including reviewer assignments, permissions, review window states, and conflict resolution rules.

Access and visibility​

Why are no campaigns visible after signing in?​

  • Reviewers: You only see campaigns where you have been explicitly assigned as a reviewer on at least one target group. Ask your Campaign Manager to verify your account assignment.
  • Campaign Managers and Viewers: Confirm you have been granted role CAMPAIGN_MANAGER or CAMPAIGN_VIEWER in group CIDAAS_RECERTIFICATION in Trustdesk (/trust-desk). If your account is not assigned to this group, the portal displays an empty or restricted state.

Why is the Review button missing or disabled?​

The Review action on a campaign card is active only when all of the following conditions are met:

  1. You are assigned as a reviewer for at least one group in the campaign.
  2. The campaign status is In Progress.
  3. The current time is within the configured review window (From to To). Submissions are locked before the start time and after campaign completion.

Review decisions and conflict resolution​

What happens if reviewers disagree in a Parallel All campaign?​

In a Parallel All campaign, every assigned reviewer must submit a decision before the user's status is finalized. When reviewers submit differing decisions on the same user in a group:

  • Keep takes precedence over Revoke: If one reviewer votes to Keep an individual role or group and another votes to Revoke, the role is retained. This fail-safe prevents accidental privilege revocation.
  • Change access: When a group contains multiple roles and only some roles are marked for removal while others are retained, the aggregated decision is recorded as Change access.
  • Audit transparency: In the Campaign Report, expand the user's row to view each reviewer's individual vote, timestamp, and optional comment.

Can a submitted review decision be undone?​

No. Once submitted, review decisions are immediately written to the immutable compliance audit log and cannot be reverted in the portal. If a mistake was made, contact your Campaign Manager so it can be noted in the audit record before the campaign completes.

Can I remove all roles from a user without removing them from the group?​

Yes, unless the target group is configured in Roles Required mode (roles_required). In Roles Required mode, users cannot hold empty role sets while retaining group membership; reviewers must either keep at least one role or choose Remove from group.

Reports and evidence export​

Does exporting respect on-screen search and filter options?​

No. CSV and JSON audit exports retrieve the complete campaign dataset directly from the server. On-screen search and filters only narrow the browser view and do not truncate the exported audit file.

Can Campaign Managers download reports, or is it restricted to Auditors?​

Both Campaign Managers and Campaign Viewers (Auditors) have full permission to view the real-time campaign report and download CSV or JSON compliance evidence.

Error and status codes​

The following structured error codes are returned by the Access Recertification service during campaign management and review submission workflows:

CodeHTTP StatusMeaningCustomer / Reviewer Remediation
RECERT-002400Invalid payload dataThe submission payload contains malformed JSON or invalid property types.
RECERT-003400Missing required parametersMandatory parameters such as campaign ID or group identifier are missing in the request.
RECERT-004404Record not foundThe requested recertification campaign or review record does not exist.
RECERT-005403Access deniedThe authenticated user does not have permission to manage this campaign or submit decisions.
RECERT-006409Campaign name already existsA campaign with the specified name already exists within the tenant. Choose a unique name.
RECERT-007409Conflicting record identifierA conflicting record exists with a different identifier. Verify input data.
RECERT-008422Campaign group validation failedGroup membership or group assignment rules could not be validated. Check group configuration.
RECERT-009409User review already completedDecisions for this user in the target group have already been submitted and finalized.
RECERT-010401UnauthorizedAuthentication token is missing, expired, or lacks recertification scopes. Re-authenticate.
RECERT-011409Roles modified concurrentlyUser roles changed between viewing the page and submitting the decision (seenRoles mismatch). Refresh the campaign view to inspect current roles before submitting.