User Provisioning vs Deprovisioning: Why Termination Controls Matter
Access-control failures often happen not when accounts are created, but when access is never updated or removed.
Provisioning
Provisioning grants access based on approved job responsibilities, least privilege, and appropriate authorization.
Changes
Transfers and role changes should trigger timely access updates so old privileges do not accumulate.
Deprovisioning
Termination or separation should trigger prompt revocation of accounts, credentials, tokens, privileged access, and remote connectivity as appropriate.
Exam strategy
Look for stale access. A technically strong authentication system still fails if former users or transferred employees keep privileges they no longer need.
The takeaway
Strong logical access control covers the full user lifecycle: approve, provision, review, modify, and promptly deprovision.
Related Summit resources
FAQ
Is account creation the only important access-control step?
No.
Should role changes trigger access review?
Yes.
Why is prompt deprovisioning important?
It prevents former users from retaining unauthorized access.