User provisioning

What it is

User provisioning is the process of creating user accounts and giving people access to the apps, systems and data they need for their job. Deprovisioning is the reverse: removing that access when it is no longer needed.

It runs across the whole employee lifecycle. Access is set up when someone joins, adjusted when they change roles and removed when they leave. IT usually owns the process, but HR data drives it, because HR knows who is joining, moving and leaving, and when.

Why it matters

A new hire with no laptop login or email on day one loses time and gets a poor first impression. On the other side, a former employee who still has access to company files is a real security risk.

Good provisioning solves both. People get the right access on time, they only get what their role needs, and access is removed quickly when they leave. It also helps with audits, because you can show who had access to what, and when.

How it works

Provisioning can be manual, with IT creating accounts from a ticket, or automated, with systems passing data to each other. A typical automated setup looks like this:

• HR adds the new hire to the HRIS with their role, team and start date.
• The identity provider (such as Microsoft Entra ID, Google Workspace or Okta) creates their main account.
• Access to apps is granted based on role or group, often using a standard called SCIM.
• The employee signs in to everything through single sign-on.
• When the person changes teams or leaves, the HRIS update triggers the access change or removal.

Example: a sales rep is hired with a Monday start date. On Thursday, HR confirms the hire. Overnight, the identity provider creates her account and adds her to the Sales group, which gives her email, the CRM and the sales chat channel. When she moves to marketing a year later, her group changes and her CRM access is removed without anyone filing a ticket.

Best practices

• Use the HRIS as the trigger for joiners, movers and leavers, so IT is never guessing.
• Give access by role, not by copying a colleague's permissions.
• Follow the principle of least privilege: only the access a person needs to do their job.
• Review access after every internal move, not just when people leave.
• Make access removal a fixed step on your offboarding checklist, timed to the last working day.

Common mistakes

• Starting provisioning on the start date, so the new hire waits for access on day one.
• Copying another user's access, which spreads permissions nobody needs.
• Forgetting apps outside SSO, like shared logins or small tools bought by one team.
• Removing access days or weeks after someone has left.

FAQ

What is the difference between provisioning and deprovisioning?

Provisioning creates accounts and grants access. Deprovisioning disables accounts and removes access, usually when someone leaves or no longer needs a tool.

What is SCIM?

SCIM (System for Cross-domain Identity Management) is an open standard that lets an identity provider create, update and remove user accounts in other apps automatically.

Who is responsible for user provisioning, HR or IT?

Usually both. HR provides the trigger and the data, like start date and role. IT sets up and manages the access. Connecting your HR tools through integrations keeps the two teams in sync.