We’ve set up a certification campaign scoped to Machine Accounts on a source, with “Account Owner” as the reviewer type. Several machine accounts have a valid ownerIdentity assigned, are enabled, and have entitlements, but they’re not showing up in the generated campaign. Only a couple of accounts with no owner at all got included, and were routed to the default/fallback reviewer.
For info, the excluded accounts were created via the create-machine-account-request-v1 endpoint, and have been aggregated and existing for several days no, so this isn’t a timing/indexing issue.
Has anyone run into this before? Any idea what could cause accounts with a valid owner to be excluded from an Account Owner campaign?
Hello Fatima. This does not look like expected behavior. In a Machine Accounts campaign, the accounts are selected from the source before the reviewer is configured. SailPoint also documents that if an account owner is not configured, the review falls back to the Source Owner, so a valid owner should not exclude the account.
I would generate another preview with the same source and campaign filter, but use Individual as the reviewer.
If the missing accounts appear, the issue is specific to the Account Owner reviewer path.
If they are still missing, confirm they appear under Machine Accounts for that source and check whether the campaign filter is excluding their access.
Also verify the owner on the current machine account after aggregation, not only the ownerIdentityId submitted during creation, since classification and mappings are reprocessed during aggregation and can change the mapped values.
If the accounts only disappear with Account Owner, I would raise it with SailPoint Support and mention that they were created through the experimental create-machine-account-request-v1 API
Thank you for your feedback. Indeed, I have already raised the issue with SP Support.
When selecting “Machine Accounts,” the reviewer can only be either the Account Owner or the Access Owner. “Individual” Reviewer is not available in the list.
The machine account owner corresponds to ownerIdentityId, even after a complete aggregation.
Are you seeing any error or warnings in the campaign generation?
This looks known issue and you need to check how NERM/Machine aggregation handled by SailPoint. you can verify the ownerIdentity with GET method v3 api.
Second you can check the correlation of that identity.