Certification Campaigns search only matches "starts with" — any plans for "contains" support?

Identity Security Cloud (ISC) ISC Discussion and Questions
, , , , ,
1

Hi everyone,

I’m relatively new to IAM/SailPoint engineering and ran into something in our tenant that I wanted to sanity-check with the community before assuming it’s a bug — turns out it’s expected behavior, but I think it’s worth a broader conversation.

We run a large volume of quarterly certification campaigns (300+ and growing), and our naming convention follows a pattern like:

Quarterly-BeyondTrust-PasswordSafe Access Review
Quarterly-BeyondTrust-PasswordSafe Service Account Access Review
Quarterly-Okta-CIAM Access Review
Quarterly-AWS Services Access Review

When I go to Admin > Certifications > Campaigns and try to search for “BeyondTrust” or “Salesforce” to quickly find every campaign related to that source, I get zero results — even though I can see the campaigns right there in the full list. The search only returns a match if I type the name starting from the very beginning of the string (e.g., “Quarterly-Beyond…”).

What I found

After digging into the API docs, this appears to be by design rather than a bug in our tenant. The Standard Collection Parameters documentation notes that individual endpoints only support a subset of filter operators per field, and the /v3/campaigns endpoint documentation confirms that the name field only supports eq (equals) and sw (starts with) — there’s no co (contains) operator available for campaign names.

Since the Certifications list UI appears to be backed by this same endpoint, the search box behaves like a “starts with” filter rather than a true substring/contains search.

Why this matters operationally

For orgs like ours where naming conventions front-load a shared prefix (e.g., cadence — “Quarterly-”, “Annual-”, “Monthly-”) before the actual source/app name, this makes it functionally impossible to search for campaigns by source or application from the UI. With a couple dozen campaigns this is a minor annoyance; with 300+ it becomes a real productivity bottleneck for anyone doing audit prep, source-specific reviews, or just trying to check “have we ever certified this source?”

What I’m looking for

A few questions for the community and anyone from SailPoint who can weigh in:

  1. Can anyone confirm whether co support on the campaigns name field is on any roadmap, or has this been raised before? (I’d rather upvote an existing idea than duplicate one.)
  2. Is there a supported way to get contains/substring search on campaigns today that I’m missing — a different admin view, a saved search, tagging campaigns, etc.?
  3. For those of you managing a similarly high campaign volume — did you solve this with a naming convention change (e.g., leading with the source name instead of the cadence), a custom reporting layer on top of the API, or something else? Would love to hear what’s worked in practice.

What I’ve tried so far

  • Confirmed the behavior is consistent across Active/Completed/Preview Ready tabs, not just “All.”
  • Pulled a subset of campaigns via GET /v3/campaigns directly — the data itself is complete and accessible, so as a stopgap I’m looking at scripting a periodic export for full-text search outside the UI.
  • Considered flipping our naming convention going forward (source name first, cadence second) so new campaigns are at least findable by “starts with,” though this doesn’t help our existing backlog.

Appreciate any pointers — and if this is indeed an open gap, happy to submit it as a formal Idea if someone can point me to whether it already exists.

Thanks!

2

Hello @supputuri,

  1. Can anyone confirm whether co support on the campaigns name field is on any roadmap, or has this been raised before? (I’d rather upvote an existing idea than duplicate one.)

    There is an idea submitted for this. You can check this. (Point no 5)

  2. Is there a supported way to get contains/substring search on campaigns today that I’m missing — a different admin view, a saved search, tagging campaigns, etc.?

    Tried exploring PowerShell SKD’s. Here we have the flexibility of using methods to get the cert campaign details and store them in a variable and then use contains operator using that variable.

  3. For those of you managing a similarly high campaign volume — did you solve this with a naming convention change (e.g., leading with the source name instead of the cadence), a custom reporting layer on top of the API, or something else? Would love to hear what’s worked in practice.

    It’s better to follow the standard prefix for all the cert campaigns. I believe you are doing it already. In that case won’t that be easy to first type in the prefix followed up with the app name? E.g., Quarterly-Salesforce. This would eventually trim down the results to very fewer.