> ## Documentation Index
> Fetch the complete documentation index at: https://conductorone-nhi-visibility-draft.mintlify.site/llms.txt
> Use this file to discover all available pages before exploring further.

# Route campaign revocations to your ITSM

> Configure C1 to automatically open an ITSM ticket whenever an access review campaign revokes access.

Route campaign-driven revocations straight into your ITSM as a ticket, instead of relying on someone to manually deprovision the account. This is especially useful for apps that don't have a connector capable of automatic deprovisioning — the ticket becomes the deprovisioning record instead.

This guide connects three C1 features: entitlement deprovisioning, ticket templates, and campaign review policies.

## Before you begin

You'll need:

* C1 **Super Administrator** role, or **Application Admin** on the apps you're configuring
* An [external ticketing provisioner already configured](/product/admin/external-ticketing) for your ITSM (Jira, ServiceNow, Freshservice, Linear, or HaloITSM)
* The name of the review policy your target campaigns use — you'll edit its follow-up steps in Step 3

## Step 1: Set the entitlement's deprovisioning method to external ticketing

A campaign revocation is deprovisioned the same way as any other revocation: using whatever [deprovisioning method](/product/admin/access-requests#set-how-app-accounts-are-deprovisioned) is set on the app. Set that method to **External ticketing** so a denied review opens a ticket instead of waiting on a manual task.

<Steps>
  <Step>
    Navigate to the **Apps** page. On the **Managed apps** tab, select the application.
  </Step>

  <Step>
    Scroll to the **Accounts management** card and find **Deprovisioning**. Click **Edit**.
  </Step>

  <Step>
    Select **External ticketing** and choose the ticket provisioner you configured.
  </Step>

  <Step>
    Click **Save**.
  </Step>
</Steps>

Denied campaign reviews for this app now open a ticket instead of a manual deprovisioning task. Repeat for each application you want covered.

## Step 2: Add revoke-aware fields to your ticket template

By default, a ticket template can't tell a grant ticket from a revoke ticket. Use `{{ .IsRevokeTicket }}` or `{{ .TicketType }}` in your [ticket template](/product/admin/external-ticketing#customizing-ticket-templates) so the ticket text, and any conditional field mappings, read correctly for both.

For example, this description template:

`Please {{ if .IsRevokeTicket }}revoke{{ else }}grant{{ end }} the {{ .Entitlement.Name }} entitlement in {{ .App.Name }} {{ if .IsRevokeTicket }}from{{ else }}to{{ end }} {{ .Subject.Email }}`

produces "Please revoke the Super Administrator Role Member entitlement in Okta from [john.doe@example.com](mailto:john.doe@example.com)" for a campaign-driven revocation.

## Step 3: Automate the revocation trigger

By default, a denied access review doesn't revoke access on its own — a Campaign Owner has to [manually revoke it](/product/admin/manage-campaigns#revoke-access-that-was-denied-during-the-campaign) after the campaign ends. To skip that manual step, update the campaign's review policy.

<Steps>
  <Step>
    Navigate to **Governance** > **Policies** and open the review policy used by your campaign.
  </Step>

  <Step>
    In the **Follow-up steps** section, set C1 to automatically create a revoke task when an access review is denied.
  </Step>

  <Step>
    Click **Save**.
  </Step>
</Steps>

Denied reviews in campaigns using this policy now automatically create a revocation task, without waiting for a Campaign Owner to trigger it manually. See [Add follow-up steps](/product/admin/policies#step-4-add-follow-up-steps) for the full policy configuration process.

## What happens next

When a reviewer denies access during a campaign that uses this policy, C1 automatically creates a revocation task, deprovisions it using the method you set in Step 1, and opens a ticket in your ITSM using the template from Step 2. Track the outcome from the [campaign report](/product/admin/manage-campaigns#generate-a-campaign-report) — add the **External ticket** and **External ticket status** columns to see ticket status per revocation.

## Frequently asked questions about revocation ticketing

<AccordionGroup>
  <Accordion title="Does this work for revocations that aren't triggered by a campaign?">
    Yes. Any revocation — manual, policy-driven, or from a denied access review — uses the same deprovisioning method set on the app or entitlement. Step 1 above applies regardless of what triggered the revocation.
  </Accordion>

  <Accordion title="What happens if I skip the follow-up step in Step 3?">
    Denied reviews still show up on the campaign's **Access reviews** tab, but a Campaign Owner has to manually revoke each one after the campaign ends. The ticket is only created once that revocation task exists, so automating the trigger is what makes the process hands-off.
  </Accordion>

  <Accordion title="Does this help with disconnected apps that have no deprovisioning connector?">
    Yes. If an app's connector doesn't support automatic deprovisioning, C1 normally falls back to a manual deprovisioning task. Setting the deprovisioning method to **External ticketing** replaces that manual fallback with an automatically created ticket in your ITSM.
  </Accordion>
</AccordionGroup>