To keep digital identities secure and organized, organizations need to have established procedures for provisioning and de-provisioning identities. These processes should be aligned to directly mirror those in the Human Resources (HR) department for onboarding and offboarding.

Provisioning is the process of creating, modifying, and deleting user accounts across an organization’s IT systems. De-provisioning is the process of revoking access rights to software and network services when an employee leaves a company or changes roles.

The high-level structure of these two processes should already be defined in the Identity & Access Management (IAM) Lifecycle. However, the specific requirements for the processes need to be defined at a granular level so that IT staff understand what steps to take when a new digital identity needs to be created.

In the provisioning process, the following steps should be taken:

  • Receive the proper authorization from management to go forward with identity creation.
  • Create the user account for the new employee in the organization’s central IAM system.
  • Assign a unique identifier (UID) to the account based on the organization’s established identity naming scheme.
  • Attach the new employee’s job role, location, and attributes to their identity so they can properly authenticate and be authorized to access resources.
  • Assign the appropriate roles to the digital identity in the Role-Based Access Control (RBAC) configuration dashboard. The organization should have clearly defined the platform-specific roles that are needed to mirror the specific employee’s job description.
  • Assign the digital identity to the appropriate user groups they require membership in.
  • Fine-tune specific permissions to digital resources if needed.
  • Review the previous steps and finalize the account creation.
  • Enroll the employee in their account and have them set their personal password and enroll secondary authentication factors.

Periodically, changes will need to be made to digital identities. Changes in job descriptions, transfers, project re-assignments, and other workplace developments can mandate such changes.

  • Modify role assignments to reflect the current job description clearly.
  • Adjust attributes to mirror developments such as location changes, last name changes, device assignments, etc.
  • Temporarily change access rights if authorized by management. This may be necessary if an employee requires access to a resource they are not typically granted access to for work purposes.
  • Perform regular role and access reviews. To keep the attack surface of digital identities tightened, regular reviews should be mandated. They should be performed by a combination of management and IT staff. Roles that should no longer be assigned, outdated attributes, and unnecessary permissions should be identified and changed. Proper audit trails and logs should be consulted for this step.

The de-provisioning process should be initiated immediately upon departure of the employee. Preferably, their identity should be unenrolled/disabled as soon as management decides on their departure.

  • Notify the employee of their termination. This common courtesy should be extended so that employees do not start work on digital resources without knowing they do not need to do it.
  • If the situation requires, the previous step can be ignored, and the digital identity can be immediately disabled.
  • Every account that the employee has access to needs to be deactivated. This is why identity sprawl needs to be reigned in, and a single centralized identity system is preferred.
  • Roles, privileges, and permissions assigned to the user accounts need to be removed from the resources they have access to.
  • Credentials need to be confiscated or invalidated. This may involve password resets on accounts, confiscation of MFA tokens, and user removal from authenticator apps.
  • Critical company data possessed by the user accounts needs to be backed up and archived before final deletion of the accounts. Organizations must have a clear data retention and archival policy in place and follow it in this step.
  • If the situation requires, audit trails of the digital identity should be consulted and archived. This is especially important in cases requiring forensic investigations.