Hosted provisioning is a service model where user creation, update, and deprovisioning flows are managed by the provider rather than by customer-run infrastructure. It reduces setup burden for identity-connected environments and can speed deployment across tenants. The main value is operational simplicity without changing the need for access governance.
Expanded Definition
Hosted provisioning is an identity operations model in which the provider runs the workflows that create, update, suspend, and deprovision accounts or service identities on behalf of the customer. In NHI environments, the term usually applies to lifecycle orchestration for tenants, applications, and connected workloads rather than to the authentication method itself. The distinction matters: hosted provisioning can simplify deployment, but it does not replace governance over who may request identities, what attributes are issued, or when access must be revoked.
Usage varies across vendors. Some describe hosted provisioning as a fully managed directory function, while others use it for SCIM-based automation delivered as a service. In practice, the relevant security question is whether the provider enforces customer-defined policy or merely executes identity changes. That difference shapes accountability, auditability, and control ownership, especially when services support delegated administration or cross-tenant synchronization. For background on lifecycle discipline, see the NHI Lifecycle Management Guide and the lifecycle section in Ultimate Guide to NHIs – Lifecycle Processes for Managing NHIs. A useful external reference for control expectations is NIST SP 800-53 Rev 5 Security and Privacy Controls, especially where identity changes must be logged and reviewed. The most common misapplication is assuming hosted provisioning equals governed provisioning, which occurs when teams outsource the workflow but fail to retain policy approval and revocation oversight.
Examples and Use Cases
Implementing hosted provisioning rigorously often introduces dependency on the provider’s change process, requiring organisations to weigh faster onboarding against reduced direct control over identity operations.
- A SaaS platform provisions tenant users automatically when a customer admin approves access, then removes them when the subscription ends.
- A managed workforce directory synchronises employee attributes from the customer HR system, but the provider executes account creation and suspension on the hosted side.
- An API gateway issues and revokes integration identities through a hosted workflow, reducing manual ticketing but increasing reliance on provider audit logs.
- A multi-tenant application uses hosted provisioning to standardise onboarding across customers, while the customer still defines RBAC and approval rules.
- A security team maps lifecycle events to the guidance in Top 10 NHI Issues and validates that the service aligns with NIST SP 800-53 Rev 5 Security and Privacy Controls for account management and auditability.
Hosted provisioning is especially useful where tenant scale makes manual lifecycle handling unreliable, but it must still support customer-defined offboarding triggers and traceable approvals.
Why It Matters in NHI Security
Hosted provisioning matters because the biggest lifecycle failures in NHI security rarely come from account creation alone. They come from stale access, missed deprovisioning, and unclear responsibility after a provider-managed workflow has been delegated. NHI Management Group data shows that only 20% of organisations have formal processes for offboarding and revoking API keys, and even fewer have procedures for rotating them, which illustrates how easily lifecycle automation can outpace governance. When provisioning is hosted, the customer may lose visibility into timing, exception handling, and evidence retention unless those requirements are contractually and technically enforced. That is why lifecycle controls, logging, and least-privilege design must remain explicit, even when the operational burden is outsourced. See also the Ultimate Guide to NHIs and the breach-oriented lessons in Coupang Signing Key Breach for how identity mishandling escalates operational risk. Organisations typically encounter the need to scrutinise hosted provisioning only after an account remains active past termination, at which point lifecycle control becomes operationally unavoidable to address.
Standards & Framework Alignment
This section maps relevant standards and security frameworks to the operational risks and controls described in this guidance.
OWASP Non-Human Identity Top 10 address the attack and risk surface, while NIST CSF 2.0, NIST SP 800-63 and NIST Zero Trust (SP 800-207) set the governance and control requirements practitioners need to meet.
| Framework | Control / Reference | Relevance |
|---|---|---|
| OWASP Non-Human Identity Top 10 | NHI-01 | Hosted provisioning depends on governed identity lifecycle automation and clear ownership. |
| NIST CSF 2.0 | PR.AC-4 | Provisioning must enforce least privilege and account authorization constraints. |
| NIST SP 800-63 | IAL2 | Identity proofing strength influences how reliably accounts are created and updated. |
| NIST Zero Trust (SP 800-207) | PA-3 | Zero Trust requires controlled identity lifecycle inputs for each managed account. |
Define approval, issuance, update, and revocation rules before delegating provisioning to a provider.
