> ## Documentation Index
> Fetch the complete documentation index at: https://docs.scaliocloud.com/llms.txt
> Use this file to discover all available pages before exploring further.
# Run Access Reviews to Certify User Access in Nexus
> Scalio Nexus access reviews let you certify that users have appropriate access to groups, apps, and roles — with automated reminders and decision tracking.
Access reviews are periodic or on-demand campaigns that ask managers or resource owners to confirm whether users should retain their current access. Nexus automates the entire lifecycle — from sending reviewer notifications to enforcing decisions at the close of the review — so your team can run a rigorous certification program without manual coordination overhead. Reviews are a core part of a zero-trust access strategy because they ensure that permissions granted in the past remain appropriate as roles, teams, and responsibilities evolve.
## Types of access reviews
Nexus supports three categories of access review, each targeting a distinct layer of your Entra estate.
Certify who should remain a member of a **security group** or **Microsoft 365 group**. Group membership is a common way to grant access to SharePoint sites, Teams channels, distribution lists, and Conditional Access policies, making it a high-value target for regular certification.
Certify who should retain access to an **enterprise application** in your tenant. This covers any app that users sign into via Entra ID, including SaaS applications, internal tools, and custom line-of-business apps integrated through the app gallery or custom registrations.
Certify who should retain assignments to **Entra ID directory roles** such as Global Administrator, User Administrator, or Exchange Administrator. Privileged role reviews are the highest-priority review type and are recommended on at least a quarterly cadence for all privileged roles.
## Creating an access review
Navigate to **Access Reviews** in the left navigation sidebar and click **New Review** in the top-right corner of the page.
Choose the type of review you want to run: **Group Membership**, **Application Access**, or **Privileged Role**. Then select the specific group, application, or role you want to certify. You can select multiple objects if you want to bundle related resources into a single review campaign.
Assign who will be responsible for making approve/deny decisions. You can designate:
* **Resource owners** — the owner of the group or application as recorded in Entra ID
* **Managers** — each user's direct manager as resolved from the Entra directory
* **Specific users** — one or more named individuals, useful for centralized review programs run by your security or compliance team
Choose between a **one-time** review for ad-hoc certification needs or a **recurring** review on a **weekly**, **monthly**, or **quarterly** cadence. For recurring reviews, Nexus automatically creates the next review instance when the current one closes.
Toggle **Auto-Apply Decisions** to control what happens when the review period ends. When enabled, Nexus automatically removes access for any user whose decision is recorded as **Deny** at the close of the review. When disabled, an administrator must manually apply the decisions after reviewing them — useful when you want a secondary verification step before access is removed.
Click **Create**. Nexus immediately sends email notifications to all assigned reviewers with a direct link to the review portal. Reviewers who have not responded receive automated reminder emails as the deadline approaches.
## Completing a review as a reviewer
When you are assigned as a reviewer, you receive an email from Nexus with a direct link to your review queue. You do not need to log in to the Nexus platform first — the link takes you directly to the review portal.
In the review portal, you see a list of every user in scope for the review. For each user you can:
* Click **Approve** to confirm the user should retain their access.
* Click **Deny** to flag the user for access removal.
* Enter a **justification note** in the text field — this is required for deny decisions and optional for approvals. Justification notes are stored in the audit log and are visible to administrators.
Once you've made decisions for all users in your queue, click **Submit Decisions**. You can return and update decisions at any time before the review deadline. Nexus tracks your completion status in real time so administrators can see who has and hasn't responded.
You can approve or deny decisions in bulk using the checkboxes on the left side of the user list. Select multiple users and use the **Bulk Approve** or **Bulk Deny** buttons that appear in the action bar.
## Monitoring review progress
The **Review Dashboard** gives administrators a live view of every active review campaign. For each review you can see:
* **Completion percentage** — the proportion of total decisions that have been submitted across all reviewers
* **Pending reviewers** — a list of reviewers who have not yet submitted any decisions, with their assigned user count
* **Decisions summary** — a breakdown of approve, deny, and not-yet-reviewed counts
* **Deadline countdown** — time remaining until the review closes, displayed as a prominent countdown
If a reviewer is unresponsive, you can send a manual reminder directly from the review dashboard or reassign their portion of the review to another user without disrupting the rest of the campaign.
When the review closes, the **Results** tab shows the full decision log — every user, every decision, every justification note, and which reviewer submitted it — formatted for export as a compliance artifact.
You can configure auto-apply to enforce decisions automatically when the review closes, or choose to apply decisions manually for an additional verification step. Manual application is recommended for high-stakes reviews such as privileged role certifications where a second set of eyes on the final results adds meaningful assurance.