IAM Foundations

Provisioning

The automated creation of accounts and access when someone joins — and, in reverse, their removal when someone leaves.

aka: deprovisioning, onboarding, offboarding

Deprovisioning follows a “disable first, delete later” rule — immediately cutting off access while retaining the account and its data for a retention window, in case an investigation or legal hold needs it. Good provisioning is fast in both directions: granting access quickly on day one, and revoking it just as quickly on the last day.