Identity lifecycle management still breaks at offboarding and review

At a glance

What this is: This is a guide to identity lifecycle management that argues the hardest failures remain offboarding, review, and timely revocation across human and machine identities.

Why it matters: It matters because IAM, IGA, PAM, and NHI programmes all depend on proving that access is removed or recertified before dormant privileges become an attack path.

Context

Identity lifecycle management is the discipline of creating, changing, reviewing, and removing access as identities move through their working life. In practice, the control fails when organisations treat provisioning as the main event and underinvest in offboarding and access review.

The article frames a familiar governance gap: manual handoffs, delayed revocation, and incomplete logging let dormant access survive role changes and departures. That problem applies to human users, contractors, service accounts, and machine identities, so lifecycle governance has to cover all of them consistently.

The central issue is not whether access was granted correctly at the start, but whether it was still justified later. That is where auditability, review cadence, and deprovisioning discipline either hold or break down.

Key questions

Q: What breaks when non-employee access is not removed at offboarding?

A: When non-employee access is not removed at offboarding, the organisation loses control of who can still reach admin, customer, or communications systems. That stale access can be used for fraud, data theft, account abuse, or reputational damage. The failure is not just technical. It is a lifecycle governance gap that leaves business-critical permissions active after the relationship ends.

Q: Why do delayed access reviews create more risk in hybrid identity environments?

A: Delayed reviews let role changes, project exceptions, and manual grants accumulate into privilege creep. In hybrid environments, that risk multiplies because the same identity may carry access across multiple systems, so a stale approval in one place can preserve an unsafe access pattern everywhere else.

Q: How can security teams tell whether identity lifecycle management is working?

A: Look for reduced stale access, consistent deprovisioning, and review outcomes that remove real entitlements rather than merely completing forms. If joiner-mover-leaver changes are reflected quickly across systems, lifecycle management is functioning. If access remains after role or status changes, the governance model is not keeping pace.

Q: What is the difference between onboarding access and lifecycle-controlled access?

A: Onboarding access grants the initial permissions needed for a role, while lifecycle-controlled access stays accurate as the identity changes and ends when the business need ends. The distinction matters because the risk is rarely the first grant, but the access that persists after the role has moved on.

Technical breakdown

Why offboarding is the highest-risk lifecycle stage

Offboarding is where lifecycle control turns from allocation to removal. If deprovisioning lags, former staff, contractors, or partners can retain live access long after their business need ends. The technical failure is usually not one system but fragmented identity state across directories, SaaS apps, cloud roles, and downstream entitlements. When revocation is not centrally orchestrated, account suspension and permission removal diverge, leaving residual access paths behind. That is why offboarding needs deterministic sequencing, not just workflow completion. Practical implication: treat identity deactivation as an enforced control event, not a best-effort HR workflow.

Practical implication: make deprovisioning atomic across all connected systems, with explicit confirmation that access removal completed everywhere.

How access reviews fail when privilege creep becomes normal

Access reviews are supposed to detect when entitlement no longer matches role. In reality, review campaigns often become administrative ceremonies that validate stale access because managers do not have enough context to make precise decisions. Privilege creep accumulates through role changes, project work, emergency access, and manual exceptions, then persists because the review process lacks clean ownership and evidence. Without authoritative logs and entitlement clarity, certification becomes a rubber stamp rather than a control. Practical implication: connect access review decisions to current role data, entitlement provenance, and removal workflows so review outcomes actually change state.

Practical implication: measure review quality by revoked access, not by review completion rate.

Why machine identities magnify lifecycle mistakes

Machine identities behave like long-lived operational assets, not temporary users. Service accounts, API keys, tokens, and certificates often outlive the teams and applications that created them, which makes ownership and retirement harder to track than for human identities. If machine credentials are not bound to a lifecycle process, they become invisible persistence mechanisms. That is why lifecycle governance for NHI has to include inventory, ownership, rotation, and offboarding together. Practical implication: manage machine identity retirement with the same discipline used for human leavers, or the oldest credentials will remain the easiest to abuse.

Practical implication: tie every non-human credential to an accountable owner and a retirement trigger.

Threat narrative

Attacker objective: The attacker objective is to exploit stale identity state so access remains available after the legitimate relationship has ended.

1. Entry occurs when an identity is created or modified with access that later outlives the business need that justified it. This can happen through delayed offboarding, stale role membership, or a forgotten service account.
2. Escalation follows when dormant entitlements accumulate and are not removed during normal review cycles. The identity retains privileges that no longer match its purpose, creating a standing-access problem.
3. Impact is unauthorized use of still-active access to reach systems, data, or administrative functions after the identity should have been closed or narrowed.

Breaches seen in the wild

• Coupang Signing Key Breach: Unrevoked signing key credentials expose 33.7 million records after employee offboarding failure at Coupang.
• Internet Archive breach 2024: An exposed GitLab token opened Internet Archive code and 31 million user records; unrotated Zendesk tokens let the attacker back in weeks later.

Read and download The State of NHI & AI Agent Breach Report 2026, covering 150+ breaches impacting Non-Human Identities including AI Agents.

NHI Mgmt Group analysis

Offboarding is not an administrative step, it is a security control boundary. Identity programmes fail when they treat leaver processing as a workflow completion problem instead of a revocation guarantee. If access is still live after the business relationship ends, the lifecycle model has already failed. Practitioners should treat deprovisioning as the point where accountability, inventory, and entitlement state must all converge.

Access review is only useful when it changes the entitlement state. Many organisations measure certification completion instead of entitlement reduction, which makes the control look healthier than it is. That is especially dangerous in hybrid estates where the same identity can hold access across directory, SaaS, cloud, and on-premises systems. The practitioner conclusion is simple: a review that does not remove or rejustify access is not a control outcome.

Machine identity lifecycle is the pressure test for governance maturity. Service accounts, API keys, tokens, and certificates frequently escape the ownership and review discipline applied to human users. That creates lifecycle blind spots that attackers can exploit long after the original project or team has changed. The implication for the field is that identity governance is no longer human-centric by default; it must prove coverage across all identity types.

Identity lifecycle management needs a named concept: entitlement persistence window. That is the period between a business change and the actual removal or narrowing of access, and it is where risk accumulates. The longer that window stays open, the more likely dormant privileges will be reused, misused, or simply forgotten. Practitioners should shrink the window as a governance objective, not just automate the process around it.

Least privilege is not established at onboarding and then assumed to hold. It must be continuously revalidated as roles, projects, and system relationships change. The article’s core lesson is that lifecycle governance is only real when access is still accurate at the end of the lifecycle, not just at the beginning. That means review, revocation, and ownership are one discipline, not three separate chores.

From our research library:

• 7% of security leaders admit they do not know how often their AI systems are making autonomous changes to infrastructure, according to the 2026 Infrastructure Identity Survey.
• Systems with least-privileged AI access had a 17% incident rate vs 76% for over-privileged systems. Organisations failing to scope AI access properly are 4.5x more likely to experience a security incident, according to the 2026 Infrastructure Identity Survey.
• Read next: NHI Lifecycle Management Guide

What this signals

Entitlement persistence window: The period between a role change or departure and the actual removal of access is where lifecycle programmes either prove control or accumulate risk. The longer that window stays open, the more likely dormant access becomes reusable access, especially in estates where directories, SaaS, and cloud permissions are not revoked together.

Identity programmes should shift measurement away from process completion and toward state change. Access review campaigns that end with approved reports but unchanged entitlements are governance theatre, not evidence of reduced exposure.

Machine identities make the lifecycle problem harder because their owners, purposes, and retirement triggers are often weaker than those for human users. Service accounts, tokens, and certificates need explicit lifecycle handling or they become long-lived exceptions that survive organisational change.

For practitioners

• Audit leaver revocation paths Map every system that receives identity state from HR, IAM, or ITSM and verify that deactivation reaches each downstream application, directory, and cloud role before the account can be reused.
• Rework access reviews around removal outcomes Require reviewers to approve, narrow, or revoke entitlements and then confirm that the downstream permission actually changed, rather than counting certifications as success.
• Inventory and own machine identities Assign a named owner, business purpose, and retirement trigger to every service account, API key, token, and certificate so non-human access cannot survive team changes unnoticed.
• Shorten the entitlement persistence window Set explicit deadlines for revocation after role change or departure and track the elapsed time between change approval and access removal as a governance metric.
• Centralise audit evidence for lifecycle decisions Keep authoritative logs of who approved, modified, or removed access so investigations and certification campaigns can reconstruct entitlement history without manual correlation.

Key takeaways

• Identity lifecycle management breaks most visibly when offboarding and access review do not produce real entitlement removal.
• The article ties lifecycle failure to delayed revocation, privilege creep, and weak auditability across human and machine identities.
• Practical control depends on proving that access state changed, not merely that a workflow, review, or approval was completed.

Key terms

• Identity Lifecycle Governance: Identity lifecycle governance is the set of processes that create, change, review, rotate, and revoke access across human and non-human identities. It matters because access risk usually increases when lifecycle events are slow, incomplete, or disconnected from the systems that rely on them.
• Privilege Creep: Privilege creep is the gradual accumulation of access rights beyond what an identity actually needs. It usually happens when permissions are added for convenience and never removed. For NHIs, privilege creep expands blast radius and makes old credentials far more dangerous than their original purpose suggests.
• Deprovisioning: Deprovisioning is the removal of access when a user changes roles or leaves an organisation. For security teams, it is the point where stale accounts, tokens, and permissions should disappear. Weak deprovisioning leaves residual access that can outlive the business need that created it.
• Access Certification: Access certification is the periodic review of whether an identity still needs its current entitlements. For NHIs, certification is only reliable when reviewers know the identity's owner, purpose, and expiry, otherwise stale machine access can persist long after the original use case has ended.

Deepen your knowledge

NHI governance, agentic AI identity, and machine identity lifecycle are core topics in our NHI Foundation Level course, the industry's only accredited NHI security programme. If you are building or maturing an IAM programme, it is worth exploring.