Browse
Identity Lifecycle & Provisioning
Automating account creation, access changes, and deprovisioning across a person's entire time at an organization.
What it is
Identity lifecycle management automates account provisioning, access changes (role transfers), and deprovisioning across the full span of someone's relationship with an organization — from day one to their last day.
Key points
- Joiner-mover-leaver: the standard framework — provisioning access on joining, adjusting it on internal moves, and revoking it on leaving — each transition is a distinct risk point if handled manually or late.
- Deprovisioning speed is the highest-risk gap: a departed employee's access that isn't promptly revoked across every system is one of the most common, and most damaging, real-world access-control failures.
- Automated provisioning (SCIM and similar): syncing identity lifecycle events from an HR system into every downstream application automatically, rather than relying on a manual ticket-driven process that's easy to miss or delay.
- Access recertification: periodic review confirming existing access is still appropriate — catches the slower-burning problem of access that accumulated correctly over time but is no longer needed.