Identity Lifecycle & Provisioning

What it is

Identity lifecycle management automates account provisioning, access changes (role transfers), and deprovisioning across the full span of someone's relationship with an organization — from day one to their last day.

Key points

• Joiner-mover-leaver: the standard framework — provisioning access on joining, adjusting it on internal moves, and revoking it on leaving — each transition is a distinct risk point if handled manually or late.
• Deprovisioning speed is the highest-risk gap: a departed employee's access that isn't promptly revoked across every system is one of the most common, and most damaging, real-world access-control failures.
• Automated provisioning (SCIM and similar): syncing identity lifecycle events from an HR system into every downstream application automatically, rather than relying on a manual ticket-driven process that's easy to miss or delay.
• Access recertification: periodic review confirming existing access is still appropriate — catches the slower-burning problem of access that accumulated correctly over time but is no longer needed.