Notifications
Clear all
Topic starter
08/07/2026 6:55 pm
TL;DR: Near real-time user provisioning and deprovisioning through Microsoft Entra ID and Okta can automate manual account handling and reduce sync gaps in larger environments, according to PassBolt. The governance issue is lifecycle accuracy: access review and offboarding processes only work when directory changes reach the target system quickly and consistently.
NHIMG editorial — based on content published by Passbolt: Simplifying User Provisioning using SCIM
By the numbers:
- Only 20% have formal processes for offboarding and revoking API keys, and even fewer have procedures for rotating them.
- 71% of NHIs are not rotated within recommended time frames, increasing the risk of compromise over time.
- 70% of organisations grant AI systems more access than they would give a human employee performing the exact same job.
Questions worth separating out
Q: How should security teams use SCIM in user lifecycle management?
A: Security teams should use SCIM to automate the movement of account state between an authoritative identity provider and downstream applications, then verify that the target system actually reflects those changes.
Q: Why do user provisioning gaps matter even when directories are synced?
A: Provisioning gaps matter because directory synchronisation only helps if the target system processes the change fast enough to remove outdated access.
Q: What breaks when SCIM is used as a substitute for access governance?
A: What breaks is the distinction between account movement and access decision-making.
Practitioner guidance
- Map the authoritative source for every lifecycle action Define which system is allowed to create, update, disable, or delete each account type, then document where SCIM is the source of execution and where human approval still applies.
- Test deprovisioning as a control outcome Run removal scenarios and verify that the downstream application reflects the directory change quickly enough to prevent stale access from surviving a normal offboarding event.
- Separate user sync from entitlement design Use SCIM to move account state, but keep entitlement decisions, privileged access, and group membership rules under explicit governance so automation does not become policy by default.
What's in the full article
Passbolt's full post covers the operational detail this post intentionally leaves for the source:
- SCIM setup steps for Passbolt Pro, including endpoint generation and token handling
- Attribute mapping examples for Microsoft Entra ID and Okta provisioning flows
- Supported and unsupported SCIM actions, including email update rejection and group sync limitations
- Implementation notes on why encrypted secret sharing changes the group lifecycle model
👉 Read Passbolt's article on SCIM provisioning for user lifecycle management →
SCIM provisioning for user lifecycle access: what changes for IAM teams?
Explore further
08/07/2026 7:17 pm
SCIM is a lifecycle control, not an identity governance strategy. The standard solves the mechanical problem of synchronising account state between a directory and a target application. It does not decide who should have access, how access should be reviewed, or which entitlements are appropriate for a given role. IAM teams should treat SCIM as the transport layer for lifecycle events, not the policy layer that governs them.
A few things that frame the scale:
- Only 20% have formal processes for offboarding and revoking API keys, and even fewer have procedures for rotating them, according to Ultimate Guide to NHIs.
- 71% of NHIs are not rotated within recommended time frames, increasing the risk of compromise over time, according to Ultimate Guide to NHIs.
A question worth separating out:
Q: How do teams handle group automation in systems that use encryption keys?
A: Teams should treat group automation in encrypted systems as a security design question, not a directory mapping exercise. If group membership changes who can decrypt or re-encrypt data, the workflow may need additional controls, approvals, or exceptions because the access effect is cryptographic, not just administrative.
👉 Read our full editorial: SCIM provisioning changes how teams govern user lifecycle access
