Provisioning and deprovisioning should be handled through a controlled identity lifecycle so users and services get access only when needed and lose it promptly when they no longer require it. Automate joins, moves, and exits where possible, and tie access removal to HR or system events. Review orphaned accounts, stale privileges, and delayed deactivation regularly.
How provisioning and deprovisioning should be run in practice
Provisioning and deprovisioning work best as a controlled lifecycle, not as one-off admin tasks. The process should create access from an authoritative source of truth, keep it aligned as roles change, and remove it quickly when the person, service, or workload no longer needs it. That is the difference between managed access and permanent access drift.
The most reliable pattern is joiner-mover-leaver handling, with automation for standard cases and human review for exceptions. For people, that usually means onboarding, role change, and exit events drive access changes. For service identities, the same principle applies: the lifecycle must also cover tokens, keys, certificates, and other credentials that can continue to authenticate after the account itself is forgotten.
Good lifecycle control also means knowing what you are provisioning. Access should be assigned from approved roles, groups, or policy, not copied from a previous user or left to accumulate after a transfer. When Joiner-Mover-Leaver (JML) Guide is used well, it becomes the operational model for keeping birthright access, role changes, and leaver removal tied to real business events.
What has to happen when access changes
Provisioning should be event-driven and deprovisioning should be authoritative, repeatable, and fast. A new starter should receive only the minimum access required for their current function, while movers should lose old access before or at the same time as new access is granted. Leavers should be disabled promptly, not left active until someone notices the account again.
That same discipline matters for non-human accounts because shared credentials and long-lived access paths are easy to overlook. The lifecycle should include orphan detection, stale privilege cleanup, and checks for accounts that were created for a project, integration, or temporary operational need but never retired. The SCIM and Automated Provisioning Guide is useful here because it focuses on how automated provisioning and deprovisioning actually fail in integration-heavy environments.
Where identity lifecycle reaches beyond people, the same control logic applies to machine and service access. The NHI Lifecycle Management Guide and the NHI lifecycle processes for managing NHIs both reinforce that provisioning is only half the job, because rotation, offboarding, and visibility are part of the same control plane.
Why provisioning failures become access creep
Provisioning and deprovisioning failures usually do not look dramatic at first. They show up as delayed joins, lingering access after role changes, stale accounts that still authenticate, and old privileges that never get removed because no one owns the cleanup. Over time, that creates access creep, audit gaps, and unnecessary paths into production systems.
The failure is usually not the initial grant. It is the missing closure. If deprovisioning depends on manual tickets, inbox follow-up, or someone remembering to close access after a departure, deactivation will always lag behind reality. The longer that lag persists, the more likely it is that dormant access becomes an unnecessary exposure. The IAM and IGA Basics guide is relevant because it frames provisioning, entitlement management, and access review as one governance problem rather than separate tasks.
When a leaver keeps access or a mover keeps old roles, the issue is not just administrative hygiene. It can preserve paths into email, SaaS platforms, source code systems, cloud consoles, or production data long after the business relationship has ended. In that sense, provision and deprovision controls are also blast-radius controls.
Risk and Threat Considerations
Provisioning delays and deprovisioning gaps create a predictable attack surface: excessive standing access, orphaned identities, and credentials that remain usable after ownership has changed. Attackers often target the gap between business reality and identity reality, because that is where stale access is least likely to be noticed quickly.
Failure mechanism: Access continues beyond its intended life because joiner, mover, and leaver events are not tied to authoritative triggers, reviews are delayed, or revocation does not reach every credential, token, and connected system.
Impact: Former users, contractors, integrations, or compromised accounts can retain access to sensitive systems, enabling unauthorized data access, privilege abuse, lateral movement, or hidden persistence.
Standards & Framework Alignment
This section maps relevant standards and security frameworks to the operational risks and controls described in this guidance.
NIST SP 800-53 Rev 5 and CIS Controls v8 set the technical controls, while ISO/IEC 27001:2022 defines the regulatory obligations.
| Framework | Control / Reference | Relevance |
|---|---|---|
| NIST SP 800-53 Rev 5 | IA-4 — Identifier Management | Covers lifecycle handling for identity issuance, changes, and removal. |
| IA-5 — Authenticator Management | Applies because deprovisioning must revoke authenticators, tokens, and similar access material. | |
| AC-2 — Account Management | Directly addresses account provisioning, disabling, and review across the lifecycle. | |
| Recommendation — Establish identity lifecycle rules so provisioning and deprovisioning stay tied to authoritative events. Revoke or invalidate authenticators when access is removed or no longer needed. Automate account creation, modification, and disabling with periodic review of inactive accounts. | ||
| CIS Controls v8 | CIS-5 — Account Management | Provides prescriptive control over account lifecycle, including removal of stale access. |
| Recommendation — Inventory accounts and remove unused or unneeded access on a defined schedule. | ||
| ISO/IEC 27001:2022 | A.5.16 — Identity management | Supports controlled identity lifecycle and authoritative assignment of access. |
| A.5.18 — Access rights | Covers granting, adjusting, and revoking access rights as part of lifecycle control. | |
| Recommendation — Define identity lifecycle ownership and approval before access is granted or changed. Review and withdraw access rights promptly when roles or employment status changes. | ||
Practitioner Guidance
What to verify: Confirm that every access grant has an owner, a source event, and a removal condition. If you cannot show where the request came from, why it was approved, and what event will remove it, the provisioning record is incomplete.
Decision rule: If the access path can authenticate to production, treat deprovisioning as time-sensitive and verify that revocation reaches sessions, tokens, keys, and any downstream application copies of the account. If it cannot be removed cleanly, classify it as an exception with explicit expiry and review.
What good looks like: Joins are fast, mover changes do not leave old access behind, and leavers are deactivated through a repeatable process rather than manual cleanup. Orphaned accounts, inactive entitlements, and stale privileges should trend down, not up.
Practitioner takeaway: The real control is not provisioning speed, it is lifecycle accuracy, because access that is created quickly but removed slowly is still unmanaged access.
Related resources from NHI Mgmt Group
- What is the difference between rotation and deprovisioning for NHIs?
- What happens when user provisioning, authentication, and deprovisioning are handled through an external service instead of inside the application?
- What is the difference between provisioning and deprovisioning in identity governance?
- What breaks when AI app provisioning and deprovisioning are manual?
Deepen Your Knowledge
Free weekly newsletter
Subscribe to the NHI & AI Identity Journal
The latest on NHI and Agentic AI security – articles, research, breaches, news and events every week.
Bonus 33% off our NHI Course when you subscribe.
Reviewed and updated by the NHIMG editorial team on October 19, 2026.
NHI Mgmt Group — the #1 independent authority on Non-Human Identity, IAM, and Agentic AI security. nhimg.org