Deprovisioning

Deprovisioning is the process of removing a user's access when it is no longer needed: disabling accounts, revoking credentials, tokens and OAuth grants, and withdrawing entitlements across every system the person could reach. It is the mirror image of provisioning — the access granted on day one — and it runs at two moments: when someone leaves the organization entirely, and when they change roles and should shed the permissions of the old one.

How it becomes a security problem

Deprovisioning fails quietly. Disabling the central identity-provider account is the easy, visible step, but modern access is scattered far beyond it: SaaS tools signed up with an email and password, API keys in scripts, shared mailboxes, code-repository memberships, and third-party apps authorized via OAuth all survive an IdP disablement untouched. Research from Wing Security in 2024 found that 63% of businesses may have former employees with access to organizational data — the accumulated residue of incomplete deprovisioning. Every account that slips through becomes an orphaned account: a valid credential with no owner, no watcher, and no expiry, exactly what an attacker with a phished or purchased password hopes to find. Delay is the other failure mode. When deprovisioning is a ticket in a queue rather than an automatic consequence of termination, a departing insider keeps working access for hours or days — and in the worst documented cases, months.

How to defend against it

Automate the trigger: the HR system's termination record should disable the identity and revoke active sessions the same hour, with no human in the loop, and role changes should trigger a re-provisioning pass rather than letting old entitlements accumulate as privilege creep. Inventory the long tail — SaaS discovery or SSPM tooling for apps outside SSO, plus registers for API keys, service accounts and shared credentials that must be rotated when a knower leaves. Verify on a schedule with user access reviews that reconcile live accounts against current staff. Deprovisioning is one step in the broader leaver process — devices, data and physical access included — covered in our guide to what happens when employees leave.