Identity Provisioning Lifecycle

• Match an account's privileges to its holder's current role across the whole joiner-mover-leaver lifecycle
• Provision joiners at least privilege, not pre-loaded with access they might need later
• On transfer, re-baseline access to the new role instead of adding to the old set
• Deprovision on termination immediately: the leaver step is the most time-sensitive in the lifecycle
• Disable access first, then delete the account on a later schedule
• A periodic access review recertifies that every account still needs every privilege it holds
• The resource or data owner recertifies access, not IT operations or security
• Privilege creep is fixed by the mover control and access reviews, not by stronger authentication
• Control privileged access with PAM: just-in-time elevation, vaulted credentials, recorded sessions
• Auditing sudo turns shared root power into individual accountability
• A break-glass account is for genuine emergencies only, and every use must alert and be reviewed
• Service accounts need a named human owner, least privilege, and the same periodic review as users
• Prefer eliminating a service account's static secret over storing one; if unavoidable, vault and rotate it
• Personnel security decides whether to trust a person; the provisioning lifecycle is the machinery that grants the access
• Role definition belongs to the business; review roles so the role itself doesn't become over-broad
• SCIM provisions and deprovisions; SAML JIT can only create/update, never deactivate
• Birthright access is auto-granted by role; HR-driven joiners are pre-staged disabled until start date
• Scale JIT provisioning by mapping policies from CMDB asset metadata, not manual entry
• Access reviews must be owner-driven, risk-prioritized, and guard against rubber-stamping

Unlock with Premium — includes all practice exams and the complete study guide.