User provisioning and deprovisioning is the controlled process of creating, updating, and removing digital access for people across systems. In IAM, it assigns accounts, roles, privileges, and attributes at joiner, mover, and leaver events, then revokes access promptly to reduce unauthorized exposure, orphaned accounts, and excess privilege.
What User Provisioning and Deprovisioning Means in IAM
user provisioning and deprovisioning is the control point where access becomes real, or is removed. It turns joiner, mover, and leaver decisions into active accounts, entitlements, and attribute changes across business systems, directory services, SaaS platforms, and sometimes cloud or privileged access layers.
The term is broader than account creation and deletion. It also covers role assignment, group membership, privilege changes, and the removal of stale access when someone changes job function or leaves entirely. Good IAM and IGA Basics are what make this process governed rather than ad hoc.
How Provisioning and Deprovisioning Works Operationally
In a mature environment, provisioning is driven by an authoritative source such as HR, a contractor system, or a sponsor workflow, then translated into system-specific entitlements through automated workflows or connectors. Deprovisioning should reverse that process quickly, including access to email, SaaS apps, VPNs, code platforms, cloud consoles, and any delegated or shared access paths.
The practical challenge is that access often accumulates over time. Movers retain old permissions, leavers keep dormant accounts alive, and exceptions get granted outside the normal workflow. The Joiner-Mover-Leaver (JML) Guide focuses on automating those lifecycle transitions so access reflects the person's current role, not their historical one.
Provisioning quality also depends on coverage. If the workflow only reaches one application while other systems are managed manually, the environment ends up with partial truth, inconsistent entitlements, and reconciliation gaps. The SCIM and Automated Provisioning Guide is useful where systems support standardised lifecycle integration.
Why Provisioning and Deprovisioning Matters for Security
This control reduces the security gap between organisational intent and actual access. Without prompt deprovisioning, orphaned accounts, excess privilege, and stale group membership become persistent exposure points that attackers can exploit after role changes or termination. The problem is not just forgotten accounts, it is abandoned authority.
It also matters for non-human access that may be attached to user workflows, such as tokens, keys, or delegated admin rights created during a person's tenure. When people leave, those access paths should be reviewed as part of the same lifecycle event because the risk is usually tied to what the person could still reach.
Employee Offboarding Security Guide shows why offboarding must include sessions, tokens, and application access, not only account disablement. For a concrete example of what can happen when offboarding fails, the Coupang Signing Key Breach illustrates how unrevoked credentials can remain dangerous after employment ends.
Common Failure Modes and Governance Signals
Most failures are lifecycle failures, not authentication failures. Typical problems include missing source-of-truth integration, delayed leaver processing, manual exceptions that never expire, access granted outside the workflow, and poor visibility into accounts created by administrators or legacy scripts.
Governance teams should watch for stale accounts, privilege creep, repeated exceptions for the same role, and systems that cannot confirm who owns an entitlement. Where workforce access is involved, Workforce Identity Security Guide is a useful companion because it ties provisioning to authentication, federation, and recovery controls that often fail alongside lifecycle automation.
For broader attack patterns around excessive access, shared access, and orphaned credentials, the Top 10 NHI Issues is a helpful reminder that lifecycle weaknesses tend to create persistent privilege, regardless of whether the identity is human or non-human.
Standards & Framework Alignment
This section maps relevant standards and security frameworks to the operational risks and controls described in this guidance.
OWASP Non-Human Identity Top 10 addresses the attack surface, NIST SP 800-53 Rev 5 and CIS Controls v8 set the technical controls, and ISO/IEC 27001:2022 defines the regulatory obligations.
| Framework | Control / Reference | Relevance |
|---|---|---|
| NIST SP 800-53 Rev 5 | AC-2 — Account Management | Defines account lifecycle control for creating, modifying and disabling access |
| IA-5 — Authenticator Management | Covers credential lifecycle when provisioning and deprovisioning affects authenticators and access material | |
| AC-6 — Least Privilege | Provisioning must assign only the access needed and remove excess privilege promptly | |
| Recommendation — Automate account creation, change, and disablement under AC-2 with documented approvals and timely revocation. Track and revoke credentials and authenticators under IA-5 when users join, move, or leave. Apply AC-6 to limit entitlements to current duties and remove unnecessary access as roles change. | ||
| ISO/IEC 27001:2022 | A.5.16 — Identity management | Annex A identity management governs lifecycle control of user identities and access rights |
| A.5.18 — Access rights | Access rights control directly covers granting, reviewing, and removing user permissions | |
| Recommendation — Implement identity lifecycle ownership so joiner, mover, and leaver changes are consistently controlled. Review and revoke access rights promptly when roles change or employment ends. | ||
| CIS Controls v8 | CIS-5 — Account Management | Prescribes managing accounts, privileges, and lifecycle hygiene across the environment |
| Recommendation — Use CIS-5 to inventory accounts and remove stale or excessive access on a regular cadence. | ||
| OWASP Non-Human Identity Top 10 | NHI-01 — Improper Offboarding | Directly addresses failure to remove access and credentials during offboarding |
| NHI-05 — Overprivileged NHI | Highlights excess privilege created when lifecycle workflows do not trim access | |
| Recommendation — Remove credentials, accounts, and delegated access as part of every offboarding process. Reconcile entitlements continuously and strip privileges that no longer match current need. | ||
Practitioner Guidance
Governance implication: Treat provisioning and deprovisioning as an owned control with measurable completion, not as a back-office admin task. The process needs clear accountability for joiner, mover, and leaver events, plus evidence that access is being created, changed, and removed on time.
What to watch for: If role changes routinely leave old access behind, or if terminations depend on manual follow-up, the process is drifting from identity governance into exception management. That is usually the signal that lifecycle automation, reconciliation, or review discipline needs attention.
Practitioner takeaway: The best provisioning model is the one that keeps access aligned to current business need with the least amount of manual correction.
Related resources from NHI Mgmt Group
- How should organisations automate user provisioning and deprovisioning across identity directories and SaaS apps?
- What is the difference between access provisioning and access deprovisioning in user governance programs?
- What do teams get wrong when they rely on manual user provisioning and deprovisioning?
- How should security teams automate user provisioning and deprovisioning when a password manager sits behind an identity provider?
Deepen Your Knowledge
Free weekly newsletter
Subscribe to the NHI & AI Identity Journal
The latest on NHI and Agentic AI security – articles, research, breaches, news and events every week.
Bonus 33% off our NHI Course when you subscribe.
Reviewed and updated by the NHIMG editorial team on October 24, 2026.
NHI Mgmt Group — the #1 independent authority on Non-Human Identity, IAM, and Agentic AI security. nhimg.org