What is the difference between provisioning NHSmail accounts manually and governing them through identity workflows?

Manual provisioning relies on people to create, update, and retire access one case at a time. Identity workflows connect those actions to source data, approvals, role rules, and certification, so access is provisioned consistently and reviewed over time. The practical difference is scale and control. Workflow driven governance reduces repetition, improves auditability, and supports faster access for legitimate users.

Manual Provisioning vs Workflow Governance: What Actually Changes

Manual provisioning treats each NHSmail account as a separate administrative action, so every create, change, suspend, or retire step depends on a person noticing the request and executing it correctly. Identity workflows turn those same actions into a governed process with defined triggers, approvals, and review points, which changes the operating model from ad hoc handling to repeatable control.

The practical difference is not just speed, it is whether access state is tied to a business event and a source of truth. With workflows, account changes can follow joiner, mover, and leaver conditions, which reduces drift and makes it easier to prove why access exists at a given point in time.

That is why workflow governance is usually the better fit when NHSmail access needs to scale across a recurring population, because the control moves from individual judgment to consistent rules. Manual handling can still be acceptable for one-off exceptions, but it becomes fragile when the same pattern repeats many times.

Why Identity Workflows Improve Auditability and Consistency

Workflow driven governance improves auditability because every action can be associated with a request, approval, policy rule, or review outcome rather than a person’s memory or inbox history. It also improves consistency because the same source data can drive provisioning decisions across many cases, instead of relying on different administrators to interpret the same need in slightly different ways.

For NHSmail, that matters when access needs to match employment status, role changes, or organisational ownership. A workflow can enforce that a user is provisioned only when the relevant conditions are met, while manual processing often leaves gaps between the request, the actual account state, and the later cleanup activity.

This is the same control logic described in NHIMG’s Ultimate Guide to NHIs and its NHI Lifecycle Management Guide: lifecycle actions are strongest when they are tied to governance, review, and retirement rather than performed as isolated admin tasks.

In practice, workflow governance also shortens the path to evidence. Teams can show who approved access, what rule created it, when it was last reviewed, and what triggered removal or recertification, which is much harder to reconstruct after manual processing.

Standards & Framework Alignment

This section maps relevant standards and security frameworks to the operational risks and controls described in this guidance.

CIS Controls v8 and NIST CSF 2.0 set the governance and control requirements practitioners need to meet.

Framework	Control / Reference	Relevance
CIS Controls v8	5 — Account Management	Manual vs workflow provisioning directly affects account lifecycle control and review.
	6 — Access Control Management	Identity workflows enforce who can receive NHSmail access and under what conditions.
Recommendation — Standardise account lifecycle handling and review access changes through governed processes. Apply least-privilege access control rules to provisioning, change, and removal events.
NIST CSF 2.0	PR.AA — Identity Management, Authentication, and Access Control	The question is about governed access provisioning and controlled access state.
	GV.RM — Risk Management Strategy	Workflow governance reduces operational and access-risk drift over time.
	PR.DS — Data Security	NHSmail access governance protects access to mail data and related sensitive information.
Recommendation — Link provisioning to identity records, approval logic, and ongoing access control reviews. Treat access governance as a repeatable risk-control process, not a one-off admin task. Restrict and review access paths that protect sensitive mailbox data.

Practitioner Guidance

What to verify: Before treating an NHSmail process as governed, confirm that every provision, change, and removal event is tied to a source record, an approval path, and a review or expiry condition. If any of those steps still depends on informal messaging or tribal knowledge, the process is still manual in the areas that matter most.

Decision rule: Use manual handling only for truly exceptional cases that need human judgment and are tightly bounded. If the same account pattern, role change, or retirement event appears repeatedly, move it into an identity workflow so the control scales with the population instead of with administrator effort.

What practitioners underestimate: The main risk is not only slower provisioning, it is stale access that survives role changes and leavers because no workflow is forcing review or retirement. That is where governance adds real value, by making access state continuously attributable rather than merely created once.

Practitioner takeaway: Manual provisioning answers the immediate request, but identity workflows govern the full lifecycle of access, which is what keeps NHSmail aligned to real business need over time.

Risk and Threat Considerations

Manual provisioning increases the chance that access remains active after it should have been removed, especially when staff move roles, leave, or change responsibilities. Over time, that creates avoidable exposure through stale accounts, incorrect entitlements, and weak evidence of who approved what.

Failure mechanism: A person forgets to update or retire access, or updates the wrong account state, and the resulting drift persists because there is no automated review or lifecycle trigger to catch it.

Impact: The organisation can end up with unnecessary access, delayed revocation, and weaker auditability, which increases the chance of inappropriate use and makes it harder to prove control over NHSmail access.