Deprovisioning
Removing access when a user leaves or changes roles. Failed deprovisioning leaves orphaned accounts that auditors flag and attackers exploit. SCIM with HR-driven triggers is the modern best practice.
Deprovisioning is the control auditors test first because it is the easiest to fail: SSO removal looks like offboarding but leaves local accounts, API keys, personal access tokens, and OAuth grants working. The gap widens with SaaS bought outside IT. Drive it from the HR record, cover non-SSO applications explicitly, and treat tokens and keys owned by the departing user as items to revoke rather than to let expire.
See also: joiner-mover-leaver, orphaned account, what is SCIM, secure offboarding checklist, user lifecycle management
Related on Start with Identity
- GlossaryAgent Registry
An agent registry is an inventory of the AI agents an organization runs or allows, recording for each one its identity, accountable human owner, purpose, permis
- GlossaryIGA
Identity Governance and Administration. The discipline of managing who has access to what, why, and for how long. Covers access certification, segregation of du
- GlossaryProvisioning
Creating user accounts and entitlements in target systems. Modern provisioning is automated via SCIM or vendor APIs, triggered by HR system events. Manual provi
- RecipeSCIM provisioning from Entra ID or Okta into a SaaS app: attribute mapping and testing deprovisioning
Paste the SaaS app's SCIM base URL and bearer token into Entra ID (Tenant URL, Secret Token) or Okta (Provisioning > Integration), confirm the matching attribut