Deprovisioning
Removing access when a user leaves or changes roles. Failed deprovisioning leaves orphaned accounts that auditors flag and attackers exploit. SCIM with HR-driven triggers is the modern best practice.
Deprovisioning is the control auditors test first because it is the easiest to fail: SSO removal looks like offboarding but leaves local accounts, API keys, personal access tokens, and OAuth grants working. The gap widens with SaaS bought outside IT. Drive it from the HR record, cover non-SSO applications explicitly, and treat tokens and keys owned by the departing user as items to revoke rather than to let expire.
See also: joiner-mover-leaver, orphaned account, what is SCIM, secure offboarding checklist
Related on Start with Identity
- GlossaryIGA
Identity Governance and Administration. The discipline of managing who has access to what, why, and for how long. Covers access certification, segregation of du
- GlossaryProvisioning
Creating user accounts and entitlements in target systems. Modern provisioning is automated via SCIM or vendor APIs, triggered by HR system events. Manual provi
- GlossarySCIM
System for Cross-domain Identity Management. A REST-based protocol for automating user and group provisioning across identity providers and downstream applicati