What breaks when organisations rely only on provisioning without reconciliation?

Why This Matters for Security Teams

Provisioning is only half of identity governance. It records intent at the moment access is granted, but it does not prove that the live system still matches that intent after manual changes, failed deprovisioning, sync delays, or shadow administration. When reconciliation is missing, directory data becomes a control plane story, not an operational truth.

That gap matters most for non-human identities, where service accounts, API keys, and workload credentials often outnumber human users and are harder to review manually. NHI Management Group’s Ultimate Guide to NHIs highlights how visibility and lifecycle failures compound risk, and the NIST SP 800-53 Rev 5 Security and Privacy Controls reinforces the need for ongoing access review, not one-time issuance. In practice, many security teams discover stale access only after an incident review exposes a privilege that was never removed.

How It Works in Practice

Provisioning creates or updates an identity record through an approved workflow. Reconciliation then compares that record against the actual state in target systems, applications, vaults, and cloud platforms. The goal is to detect drift: accounts created outside the workflow, privileges added directly in an application, disabled accounts that are still active, and secrets that remain valid after the associated record has been changed.

For NHIs, the operational pattern usually includes three checks. First, compare the source-of-truth directory to every system that can mint or hold access, including CI/CD tools, secret stores, cloud IAM, and application-local user stores. Second, validate that entitlements still match approved ownership, purpose, and expiry. Third, reconcile evidence of live usage, because an account that exists in the directory but is not truly disabled in the application is still a working access path.

Current best practice is to pair reconciliation with lifecycle controls such as rotation, deactivation, and periodic attestation. The NHI Lifecycle Management Guide and the Top 10 NHI Issues both stress that visibility without verification is incomplete governance. NIST also expects organisations to monitor and review access over time, which is why reconciliation should feed alerts, ticketing, and exception handling rather than remain a quarterly spreadsheet exercise.

• Compare provisioned accounts to live system state on a scheduled and event-driven basis.
• Flag direct edits, local admin changes, and out-of-band account creation.
• Reconcile enabled status, role membership, secret validity, and ownership.
• Require closure actions for every unexplained drift event.

These controls tend to break down in environments with many disconnected SaaS apps, local databases, or legacy platforms because the organisation cannot reliably query the live entitlement state.

Common Variations and Edge Cases

Tighter reconciliation often increases operational overhead, requiring organisations to balance stronger governance against system complexity and change velocity. That tradeoff becomes sharper where access is granted by automation, temporary pipelines, or third-party administrators who can mutate state faster than a central IAM process can observe it.

There is no universal standard for exact reconciliation frequency yet. Some environments need near-real-time checks for privileged NHIs, while lower-risk systems can tolerate batch review if drift is low and the blast radius is limited. The key is to align the cadence to the sensitivity of the asset, not to an arbitrary calendar.

Edge cases usually appear when the system of record is not the system that actually enforces access. For example, a service account may be disabled in the directory but still accepted by an application cache, or a secret may remain valid even after the account owner has been removed. The same problem can also show up with ephemeral cloud resources that are recreated faster than governance tools refresh their inventory. NHI Management Group’s Lifecycle Processes for Managing NHIs is useful here because it frames reconciliation as part of the lifecycle, not a separate audit task.

For regulated environments, the practical question is not whether provisioning happened correctly, but whether the current state still matches the approved state. When that answer cannot be demonstrated, reconciliation has already failed.

Related resources from NHI Mgmt Group

• What breaks when organisations rely on manual user provisioning in large trust ecosystems?
• What breaks when organisations rely on convenience features without reviewing fallback authentication paths?
• What breaks when organisations rely on provisioning without governance?
• What breaks when organisations rely on always-on desktop access instead of just-in-time access for remote users?