Skip to main content
Route campaign-driven revocations straight into your ITSM as a ticket, instead of relying on someone to manually deprovision the account. This is especially useful for apps that don’t have a connector capable of automatic deprovisioning — the ticket becomes the deprovisioning record instead. This guide connects three C1 features: entitlement deprovisioning, ticket templates, and campaign review policies.

​
Before you begin

You’ll need:
  • C1 Super Administrator role, or Application Admin on the apps you’re configuring
  • An external ticketing provisioner already configured for your ITSM (Jira, ServiceNow, Freshservice, Linear, or HaloITSM)
  • The name of the review policy your target campaigns use — you’ll edit its follow-up steps in Step 3

​
Step 1: Set the entitlement’s deprovisioning method to external ticketing

A campaign revocation is deprovisioned the same way as any other revocation: using whatever deprovisioning method is set on the app. Set that method to External ticketing so a denied review opens a ticket instead of waiting on a manual task.
1
Navigate to the Apps page. On the Managed apps tab, select the application.
2
Scroll to the Accounts management card and find Deprovisioning. Click Edit.
3
Select External ticketing and choose the ticket provisioner you configured.
4
Click Save.
Denied campaign reviews for this app now open a ticket instead of a manual deprovisioning task. Repeat for each application you want covered.

​
Step 2: Add revoke-aware fields to your ticket template

By default, a ticket template can’t tell a grant ticket from a revoke ticket. Use {{ .IsRevokeTicket }} or {{ .TicketType }} in your ticket template so the ticket text, and any conditional field mappings, read correctly for both. For example, this description template: Please {{ if .IsRevokeTicket }}revoke{{ else }}grant{{ end }} the {{ .Entitlement.Name }} entitlement in {{ .App.Name }} {{ if .IsRevokeTicket }}from{{ else }}to{{ end }} {{ .Subject.Email }} produces “Please revoke the Super Administrator Role Member entitlement in Okta from john.doe@example.com” for a campaign-driven revocation.

​
Step 3: Automate the revocation trigger

By default, a denied access review doesn’t revoke access on its own — a Campaign Owner has to manually revoke it after the campaign ends. To skip that manual step, update the campaign’s review policy.
1
Navigate to Governance > Policies and open the review policy used by your campaign.
2
In the Follow-up steps section, set C1 to automatically create a revoke task when an access review is denied.
3
Click Save.
Denied reviews in campaigns using this policy now automatically create a revocation task, without waiting for a Campaign Owner to trigger it manually. See Add follow-up steps for the full policy configuration process.

​
What happens next

When a reviewer denies access during a campaign that uses this policy, C1 automatically creates a revocation task, deprovisions it using the method you set in Step 1, and opens a ticket in your ITSM using the template from Step 2. Track the outcome from the campaign report — add the External ticket and External ticket status columns to see ticket status per revocation.

​
Frequently asked questions about revocation ticketing

Yes. Any revocation — manual, policy-driven, or from a denied access review — uses the same deprovisioning method set on the app or entitlement. Step 1 above applies regardless of what triggered the revocation.
Denied reviews still show up on the campaign’s Access reviews tab, but a Campaign Owner has to manually revoke each one after the campaign ends. The ticket is only created once that revocation task exists, so automating the trigger is what makes the process hands-off.
Yes. If an app’s connector doesn’t support automatic deprovisioning, C1 normally falls back to a manual deprovisioning task. Setting the deprovisioning method to External ticketing replaces that manual fallback with an automatically created ticket in your ITSM.