Topic starter
06/11/2026 6:37 pm
TL;DR: Manual offboarding leaves Slack, Outlook and GitHub access behind after employment ends, according to Serval, while automated deprovisioning ties revocation to lifecycle events and creates a consistent audit trail. Least privilege only remains real when stale permissions are removed as reliably as they are granted.
Editorial analysis by NHI Mgmt Group, based on content published by Serval: “How automatic deprovisioning works when an employee leaves”.
Key questions
A: Security teams should treat offboarding as an orchestrated identity workflow, not a single IT action.
Q: Why do dormant accounts remain a security risk after someone leaves?
A: Dormant accounts remain a risk because the credentials, tokens, or certificates attached to them may still authenticate after the person has left.
Q: What is the difference between provisioning and deprovisioning in identity governance?
A: Provisioning grants access when a user or system needs it, while deprovisioning removes that access when the need ends.
Practitioner guidance
- Tie offboarding to a single authoritative trigger Use the HR system or other trusted source as the event that starts revocation, then confirm that every connected application receives the change.
- Inventory the applications that still need manual revocation List the apps outside your IdP connector footprint and assign a removal path for each, including cases where the API exists but no standard connector does.
- Measure revocation completion time Track how long it takes to remove access from separation to final deprovisioning across your highest-risk systems and treat delays as control failures.
Bottom line: Automated deprovisioning matters because active accounts often survive role changes and departures long enough to become an exposure point.
Explore further
View Full Forum → | NHI Foundation Course → | Our Services → | Read the full analysis →
06/11/2026 6:41 pm
Automated deprovisioning is a lifecycle control, not an admin convenience. The security value comes from binding access removal to a governed event, not from saving IT time. When removal is manual, the control depends on memory, ticket discipline and application-by-application follow-through. The implication is that access revocation should be treated as part of identity governance architecture, not as a back-office task.
A few things that frame the scale:
- Over 70% of organisations lack automated access risk analysis, user access reviews and provisioning and deprovisioning, according to Pathlock's 2025 Digital Transformation and Access Risk Report.
A question worth separating out:
Q: How do auditors verify that access was removed on time?
A: Auditors verify timely removal by comparing joiner-mover-leaver records, deprovisioning tickets, and identity logs to confirm the account was disabled, roles were revoked, or privileged access was removed within the required timeframe. They look for evidence such as access review sign-off, timestamped change records, and IAM or PAM logs that show the entitlement ended when the employment or contract event occurred.
👉 Read our full editorial: Automated deprovisioning closes the offboarding gap in IAM