Provisioning is working when account creation, attribute changes, and removals in connected applications match the authoritative identity source without backlog or manual exceptions. The clearest signal is whether offboarding removes access cleanly and role changes propagate before users need to self-correct.