What is user provisioning and deprovisioning?
User provisioning is creating accounts and granting access when someone joins or changes roles. Deprovisioning is removing that access when they leave or no longer need it, ideally on their last day. SCIM (System for Cross-domain Identity Management) is the common standard for automating both from an identity provider.
What the buyer is really asking
What buyers care about most is offboarding: how fast a departing employee loses access to everything. Give a timeframe and name the system that makes it happen.
Other ways buyers ask it
Every one of these wants the same answer:
- “Describe your onboarding and offboarding process.”
- “How quickly is access revoked when an employee leaves?”
- “How is access provisioned for new employees?”
Evidence to have ready
- An offboarding checklist or runbook
- Identity provider records showing deactivation
- A recent example of access removal with timestamps
Sample answers by company stage
The right answer depends on what you actually run today. Each sample below is honest only if its condition is true for you. Swap the bracketed details for your own.
Early startup
Use this if: You manage accounts by hand from a checklist, and most of your tools sign in through Google Workspace or a similar identity provider.
New employees get accounts from [our operations lead] using a standard onboarding checklist, with access based on their role. Most of our tools use sign-in through [Google Workspace], so disabling that one account removes access to them at once. When someone leaves, we disable their [Google Workspace] account on their last day. We then work through an offboarding checklist for tools outside single sign-on, including [AWS and GitHub]. We complete offboarding within [24 hours] of departure and keep a record of each completed checklist.
Scaling
Use this if: An identity provider is your source of truth for workforce access, and HR events drive account changes.
[Okta] is our identity provider and the source of truth for workforce access. Accounts are created from [our HR system] once a new hire's start date is confirmed. Role-based groups grant their default access. Access beyond the default needs a ticket approved by the employee's manager and the system owner. On termination, HR triggers deactivation in [Okta], which removes access to every connected application immediately. Accounts in systems outside single sign-on are removed within [24 hours] using our offboarding checklist. A role change triggers a review that removes access the new role does not need. Quarterly access reviews catch anything the process missed.
Enterprise-ready
Use this if: Provisioning is automated end to end with SCIM, and an auditor has sampled your terminations.
Provisioning and deprovisioning are automated from [Workday] through [Okta] to connected applications using SCIM. Involuntary terminations are deprovisioned within [1 hour]. Voluntary departures are deprovisioned by the end of the last working day. Production and other privileged access is never part of a default role and is requested per use through [our access tool]. Service accounts and API keys owned by a departing employee are reassigned or rotated during offboarding. Contractors follow the same process with an end date set when their account is created. Our SOC 2 Type II auditor samples terminations each period and checks access removal against these timelines.
How the major questionnaires word it
Each standard questionnaire asks this in its own structure. These are paraphrased summaries, not the licensed question text.
- CAIQ v4 (Cloud Security Alliance)
- The Identity and Access Management domain has separate rows for provisioning, for changing and revoking access, and for periodic reviews. The revocation row is about timeliness when people leave or change roles. A number of hours or days answers it best.
- SIG (Shared Assessments)
- SIG asks whether a documented process exists to grant, change, and revoke access. It also asks whether revocation is tied to HR termination and how fast it happens. A similar question can appear again in the human resources section, so keep both answers consistent.
- VSA (Vendor Security Alliance)
- VSA-style questionnaires focus on how quickly access is removed at termination and whether that includes production systems and cloud consoles, not only email.
- HECVAT (higher education)
- HECVAT covers account management and prompt deprovisioning. It often means the institution's own users inside your product, managed through their SSO or SCIM. When the wording is unclear, answer for your workforce and for customer accounts.
More evidence reviewers accept
- A list of terminations for a recent period matched against identity provider deactivation times
- SCIM configuration for your connected applications
- An inventory of systems outside single sign-on, each with a named owner
- Access request tickets showing manager and system owner approval
- A document mapping each role to its default groups and access
Red flags reviewers look for
- No timeframe. Promptly or as soon as possible is not an answer. Reviewers want a number of hours they can put in a contract.
- Shared accounts. If a login is shared, deactivating one person does not remove their access. Any mention of shared credentials becomes a finding.
- Forgotten tools outside SSO. The cloud root account, domain registrar, payment dashboard, and social accounts are the classic gaps. Name how your checklist covers them.
- Access that grows with every role change. People who move teams often keep their old access. Reviewers ask whether transfers trigger removal, not only additions.
- Contractors outside the process. Contractors managed in a spreadsheet instead of the identity provider are a common audit exception. Say how their access ends.
Follow-up questions to expect
Can you show us a recent offboarding?
Have one ready. A redacted checklist with the departure date and deactivation timestamps from your identity provider answers it in a minute.
Do you revoke access before or after the exit conversation?
For involuntary terminations, buyers expect access removed during or before the conversation. Say how HR and whoever runs the identity provider coordinate on timing.
How do you handle access for contractors and vendors?
Say whether contractors live in the same identity provider, whether their accounts expire automatically, and who approves their access. Contractor accounts with no end date are a common finding.
Do you support SCIM for our users in your product?
This one is about the buyer's own employees in your application, not your workforce. Answer yes only if their identity provider can create and remove users in your product without manual steps.
How do you make sure nothing was missed?
Two mechanisms usually answer this. First, compare the HR termination list against active accounts every month, both in the identity provider and in the tools outside it. Second, run a periodic access review where system owners confirm every account still belongs to a current employee. Say how often each runs and who signs off. If you do neither yet, say what you check at offboarding and leave the rest out.
How Tyrvar answers this
Tyrvar treats every wording above as one question. You write the answer once, attach the evidence, and revisit it when your setup changes. Each buyer gets that approved answer no matter how their questionnaire words it. If you have not answered it yet, Tyrvar flags the question for you and does not make something up. Try it on your own questionnaire.