Contractor Identity Lifecycle Guide: Onboarding, Access Reviews and Offboarding

Contractors, consultants and agency staff often hold the same access as employees, but they usually sit outside the HR system that drives joiner, mover and leaver processes, so nobody is told when they start, change role or leave. The result is accounts created by hand, sponsors who have moved on, guest identities that outlive the contract by years and, more recently, fake workers who were never the person on the paperwork. This guide covers the contractor lifecycle from sponsorship and identity proofing through guest and B2B accounts, time-bound access and reviews, to offboarding when no HR event will ever fire. It is written for IAM and IGA practitioners, and for the procurement, HR and security leaders who share ownership of non-employee workers.

Key takeaways

• Create a system of record for non-employees before you automate anything: if contractors are not in HR, they must be in a vendor management system, an IGA non-employee module or a dedicated directory feed with a named sponsor and an end date.
• Every contractor identity needs an accountable sponsor who approves access, attests to it in reviews and is replaced automatically when they leave or move.
• Make expiry the default, not the exception: accounts and entitlements should carry an end date tied to the contract, so access lapses without anyone having to remember.
• Proof identity at onboarding and again at device issue, because remote hiring through staffing agencies is the main route used by fake IT worker schemes.
• Offboarding must be triggered by more than HR: contract end dates, purchase order closure, sponsor attestation, inactivity and supplier notifications all need to feed the leaver process.

Why contractor identities fall through the gaps

Employee lifecycle automation usually starts with an HR system such as Workday or SAP SuccessFactors pushing joiner, mover and leaver events to the identity provider or IGA platform. Contractors break this model in several ways:

• No authoritative source: contractors are often engaged through procurement, a managed service provider or a business unit budget, so HR has no record and the identity team learns about them from a ticket.
• Multiple onboarding routes: the same person may get a full workforce account, a B2B guest account in a collaboration tenant, a local account in a SaaS application and a VPN profile issued by the supplier, each created by different teams.
• Weak end dates: contracts are extended informally, statements of work end early, and agencies replace one person with another under the same purchase order.
• Orphaned sponsorship: the manager who requested access leaves, and nobody inherits accountability for the contractor.
• Identity assurance: agencies and subcontractors may run their own vetting, but the hiring organisation rarely sees the evidence, and remote onboarding means nobody from the organisation ever meets the worker.

Attackers notice. ATT&CK lists T1199 Trusted Relationship and T1078 Valid Accounts as initial access techniques, and a contractor's account is both. The Uber breach in 2022 started with a contractor's password and MFA fatigue. For the wider supplier access model, see the Third-Party Access Guide.

Contractor types and the account model for each

Not every external person needs the same kind of identity. Choosing the right model up front decides how easily you can review and remove access later.

• Decision rule: if the person needs a managed device, internal network access or privileged rights, give them a workforce account you fully control. If they only collaborate on content and their employer runs a competent identity provider, a federated guest account keeps credential management, MFA and leaver handling at their home organisation.
• Naming and flags: mark non-employees with an attribute such as employeeType = Contractor or a distinct UPN prefix, so conditional access, DLP and reviews can target them.
• Privileged contractors: route administrative access through the same vaulting, session recording and just-in-time elevation as staff. See the Privileged Access Management Guide.

Sponsorship and the non-employee system of record

A sponsor is the employee who is accountable for a contractor: they request and approve access, confirm the contractor still needs it, and trigger removal when the engagement ends. Microsoft Entra ID, for example, has a Sponsors field on guest user objects that can hold users or groups (up to five can be added at invitation); if no sponsor is specified, the inviter becomes the sponsor automatically. Microsoft documents that the field grants no administrative rights and that guests invited by sharing a file in SharePoint do not receive a sponsor automatically, so a periodic report of guests without sponsors is needed.

• Minimum record: legal name, employing organisation, contract or purchase order reference, sponsor, cost centre, start date, planned end date, worker classification and assurance level achieved at onboarding.
• Group sponsorship: use a team or role group as a secondary sponsor, so accountability survives a single manager leaving.
• Sponsor departure: when a sponsor becomes a leaver or mover in HR, route every contractor they sponsor to the new manager for reassignment within a fixed period, and suspend access if nobody accepts.
• Where the record lives: options are a vendor management system feeding the IGA platform, a non-employee module inside the IGA tool, or a simple controlled database feeding the directory. The choice matters less than having exactly one authoritative source with an end date on every record.

The employee version of this process is covered in the Joiner-Mover-Leaver Guide; this section focuses only on what differs for non-employees.

Onboarding with identity proofing

Remote onboarding through agencies is the route used by North Korean IT worker schemes. In June 2025 the US Department of Justice announced searches of 29 suspected laptop farms across 16 states and alleged that North Korean workers had obtained remote jobs at more than 100 US companies using the identities of more than 80 US persons, with facilitators hosting company laptops connected to KVM switches. The FBI public service announcement of 23 July 2025 (I-072325-4-PSA) gives employers specific controls, several of which belong in the contractor onboarding workflow. For the threat itself, see the Insider Threat from Fake IT Workers Guide.

1. Set an assurance target by role. NIST SP 800-63A defines identity assurance levels: IAL1 and IAL2 can be achieved remotely or on-site, while IAL3 requires an on-site attended session with a trained proofing agent. Contractors with source code, production or privileged access should be proofed to at least the equivalent of IAL2, with a remote attended (live video) session rather than a fully automated one where the risk justifies it.
2. Verify documents and history directly. The FBI recommends checking identity documents for inconsistencies, comparing photos and contact details against public profiles, and confirming previous employment and education directly with the employers and institutions rather than through contacts supplied by the candidate.
3. Bind the interviewed person to the worker. Capture an image at interview and compare it at later meetings and at credential issue, since one person may interview and another may do the work. Require video with an unobscured background.
4. Push requirements to staffing firms. The FBI advises educating third-party vendors that supply contract IT workers. Put proofing standards, right-to-audit and notification duties in the supplier contract.
5. Control device shipping. Ship laptops only to the address on the worker's identity documents, require extra evidence for any change, and do not grant system access until background checks are complete.
6. Issue credentials in a bound ceremony. Register phishing-resistant MFA (passkeys or security keys) during a live, verified session rather than emailing an activation link. See the Identity Proofing and KYC Guide and the Phishing-Resistant MFA Guide.

Finance and procurement can add signals the identity team cannot see: the FBI notes shared bank details across workers, frequent bank account changes and requests for payment in virtual currency as warning signs.

Guest and B2B accounts

B2B collaboration lets external users sign in with their own organisation's credentials, which is often safer than issuing a password you must manage. The risk is sprawl: guests accumulate through ad hoc invitations and are rarely removed.

• Connected organisations: in Microsoft Entra entitlement management, a connected organisation defines a partner by its Entra directory, a federated SAML or WS-Fed identity provider, an email domain or Microsoft accounts. Organisations created automatically when a user from an unknown domain is approved start in the Proposed state and are excluded from policies scoped to all configured connected organisations until an administrator configures them.
• Access packages with expiry: grant guests access through packages that bundle groups, applications and sites, with an approval step (the sponsor) and an assignment end date or duration.
• Lifecycle of external users: Microsoft documents that by default, when an external user invited through entitlement management loses their last access package assignment, they are blocked from signing in and their guest account is removed after 30 days. The settings are Block external user from signing in to this directory, Remove external user and Number of days before removing external user from this directory. These actions apply only to guests invited through entitlement management or converted to governed, so guests created by older invitations need separate clean-up.
• Restrict invitations: limit who can invite guests, use allow or deny lists of partner domains, and apply conditional access to guests (MFA, device or location rules, and trusting partner MFA only where you have assessed it).
• Other platforms: Google Workspace, Okta and SaaS applications have equivalent external sharing, guest and B2B features. The principles are the same: named sponsor, explicit expiry, scoped access and automatic removal.

Time-bound access and reviews

Expiry should be the first line of control, with reviews catching what expiry misses. NIST SP 800-53 AC-2(2) calls for automatic removal or disabling of temporary and emergency accounts after a defined period, and AC-2(3) for disabling accounts that have expired, are no longer associated with a user, are in violation of policy or have been inactive for a defined period.

• Reviewer choice: the sponsor reviews whether the person should still have access at all; the resource owner reviews whether the access level is right. Avoid letting a contractor attest to their own access for anything beyond low-risk guest collaboration.
• Non-response: treat no response as removal. Microsoft's guest access review guidance supports setting If reviewers don't respond to Remove access and applying Block from signing in for 30 days then remove user from the tenant to denied guests, and recommends removing guests who never accepted their invitation (shown as "Not Notified").
• Scope reviews with attributes: a dynamic group based on userType eq Guest or your non-employee flag makes contractor-only reviews straightforward.

Review design, reviewer fatigue and evidence for auditors are covered in the Access Reviews Guide.

Offboarding when HR does not know

For employees, termination in HR drives deprovisioning. For contractors you need several triggers, because any one of them can fail.

1. Disable first, delete later. Block sign-in and revoke refresh tokens and sessions immediately; keep the object for a hold period (30 to 90 days) for investigations and handover, then delete.
2. Remove what the account created. Personal access tokens, API keys, OAuth grants, SSH keys and service accounts created by the contractor do not disappear with the account. Transfer ownership or revoke them. See the NHI Offboarding and Decommissioning Guide.
3. Cover local and SaaS accounts. Use SCIM where available and a reconciliation report for applications that keep local accounts.
4. Recover devices and data. Retrieve or remotely wipe issued devices, and remove the contractor from shared vaults, code repositories and data rooms.
5. Rotate shared secrets the contractor knew. Any credential they could read in a vault or configuration should be rotated, which is far easier if they never had standing access to it.

The CISA Private-CISA GitHub leak shows why the last two steps matter: a contractor's public repository exposed AWS GovCloud administrator keys for months. Employee-focused leaver steps are covered in the Employee Offboarding Security Guide.

Implementing the programme in phases

1. Discover (weeks 1 to 4): export all accounts not linked to an HR record, all guest accounts and all accounts with an external email domain; match them to suppliers, purchase orders and sponsors. Expect a large unknown population on the first pass.
2. Clean up in audit mode: send sponsor attestation requests for every unmatched identity, report without disabling for one cycle, then disable those still unclaimed after a published deadline. Keep a fast re-enable path through the service desk as the rollback.
3. Establish the system of record: stand up the non-employee source, make end date and sponsor mandatory fields, and connect it to the IGA or identity provider as an authoritative feed.
4. Automate expiry and triggers: apply end dates to accounts and entitlements, enable inactivity disablement and sponsor-departure handling, starting with a pilot business unit.
5. Add onboarding assurance: introduce proofing and device-shipping controls for new engagements, beginning with roles that have privileged, code or production access, and update supplier contracts at renewal.
6. Govern guests: move collaboration onto access packages with expiry, convert legacy guests to governed or remove them, and restrict ad hoc invitations.
7. Review and measure: run the first contractor-only review, track the metrics below and tune thresholds.

Small versus large organisations: a small organisation can run this with a spreadsheet register owned by one person, identity provider expiry dates and a quarterly guest review. A large organisation with thousands of contingent workers needs a VMS integration, IGA non-employee lifecycle workflows and contractual notification duties with every staffing supplier.

Detection and measurement

• What to log and alert on: sign-ins by contractor accounts after their end date (should be impossible), sign-ins from unexpected countries or hosting providers, remote access or remote management tools installed on contractor devices, multiple workers sharing bank details or shipping addresses, new MFA methods registered shortly after onboarding, and privilege grants to non-employees outside an access package.
• Fake worker indicators: camera always off, inconsistent voice or appearance across meetings, KVM devices or unusual peripherals reported by endpoint tools, and logins that consistently originate from residential proxies or VPNs.

Metrics that show the programme is working:

1. Percentage of non-employee identities with a valid sponsor and end date (target 100 percent).
2. Median hours from contract end to account disable (target under 24 hours).
3. Number of enabled contractor or guest accounts with no sign-in for more than 45 days.
4. Percentage of contractor review decisions completed on time, and percentage that result in removal.
5. Guest accounts not governed by an access package or invitation expiry.
6. New contractor engagements onboarded with documented identity proofing at the required level.

Common failure patterns

• Treating the supplier as the identity: one account per agency, shared among rotating staff, makes attribution and removal impossible.
• End dates that are extended in bulk: when expiry causes disruption, teams push all end dates out by a year, which quietly restores standing access. Fix the warning and extension workflow instead.
• Sponsor is a single person: when they leave, contractors keep access with nobody accountable.
• Guest clean-up that ignores legacy invitations: lifecycle automation often only covers guests created through the governed route.
• Proofing done once, by someone else: relying entirely on an agency's vetting without seeing evidence, and never comparing the onboarded person with the person working.
• Deprovisioning the account but not its credentials: tokens and keys created by the contractor keep working, as in the GitHub leak above.

Framework mapping

NIST SP 800-53 PS-7 specifically requires organisations to establish personnel security requirements for external providers and to require them to notify the organisation of transfers or terminations of external personnel who hold credentials or privileges, which is the contractual hook for the supplier notification trigger above.

Practitioner checklist

• Run a discovery report of every account not linked to an HR record and match each to a sponsor and contract.
• Make one system of record authoritative for non-employees, with mandatory sponsor and end date fields.
• Assign group or secondary sponsors and handle sponsor departure automatically.
• Set identity proofing levels by role and apply FBI device-shipping and interview controls for remote engagements.
• Issue phishing-resistant MFA in a verified session, never by emailed activation link.
• Put end dates on accounts and on entitlements, and disable inactive contractor accounts after 30 to 45 days.
• Govern guests through access packages with expiry, and remove or convert legacy guests.
• Run contractor-only access reviews at least quarterly for sensitive access, with non-response treated as removal.
• Add leaver and replacement notification duties to every staffing and services contract.
• At offboarding, revoke sessions, tokens, keys and OAuth grants, recover devices and rotate shared secrets.

Standards and references

• NIST: SP 800-53 Rev. 5 (AC-2, PS-3, PS-4, PS-7, IA-12)
• NIST: SP 800-63A-4 Digital Identity Guidelines, Identity Proofing and Enrollment
• NIST: Cybersecurity Framework 2.0
• FBI IC3: Public Service Announcement I-072325-4-PSA on North Korean IT Workers
• US Department of Justice: Coordinated Nationwide Actions to Combat North Korean Remote IT Workers
• Microsoft Learn: Govern access for external users in entitlement management
• Microsoft Learn: Manage guest access with access reviews
• Microsoft Learn: Sponsors for B2B guest users

Related NHI Mgmt Group resources: Joiner-Mover-Leaver Guide · Access Reviews Guide · Insider Threat from Fake IT Workers Guide · Third-Party Access Guide