What is deprovisioning?
Deprovisioning is the identity and access work that undoes provisioning. When someone leaves the organization, their accounts are disabled, their sessions and tokens are revoked and their credentials are retired. When someone changes roles, the access tied to the old job comes off as the new access goes on. Contractors, interns and vendor staff need the same treatment when their engagements end, and so do service accounts when the software that used them is retired. Offboarding is the wider departure process, including HR paperwork and device return; deprovisioning is the part that makes sure access actually stops.
What a complete deprovisioning covers
- Disable the directory account no later than the moment the person is told, especially when the departure is involuntary.
- Revoke refresh tokens and identity provider sessions, and sign the user out of applications that keep sessions of their own.
- Remove group memberships, privileged roles, VPN and remote access rights, and registered MFA methods.
- Shut off access the directory does not control: local logins on switches and firewalls, SaaS apps that bypass single sign-on, and personal API or SSH keys.
- Change any shared passwords or keys the person could use, such as vendor portal logins and service account passwords.
- Collect devices and badges, wipe company data from personal phones, and hand the person's mailbox and files to their manager.
- Delete the account only after a retention period, keeping it disabled until then in case of a legal hold or investigation.
Example: the account that outlived the job
A quarterly review compares the enabled accounts in each business application with the HR system's list of active staff. In the CRM it finds 23 enabled accounts that match no current employee. One belongs to a sales manager who left in June. Her directory account was disabled on her last day, but the CRM used its own logins, and in August her CRM account exported the customer list. Two fixes follow: connect the CRM to single sign-on and automated provisioning so directory changes reach it, and run the comparison monthly. In Active Directory, a common starting point for finding stale accounts is:
Search-ADAccount -AccountInactive -TimeSpan 90.00:00:00 -UsersOnly
Accounts whose owner has gone, called orphaned accounts, are attractive to attackers because nobody notices when they are used.
Automating deprovisioning
A manual process depends on someone remembering to file a ticket, and removals are the tickets that get forgotten. The reliable pattern is HR-driven: the termination or transfer date entered in the HR system triggers the identity platform, which disables or changes the account and pushes the change to connected applications, often through SCIM. Windows records event 4725 when an account is disabled and 4726 when it is deleted, which gives auditors a trail to compare with HR dates. Periodic access reviews then catch what automation missed.
Deprovisioning vs. disabling vs. deleting
Disabling blocks new sign-ins but keeps the account, its memberships and its history. Deleting removes it. In Active Directory, permissions reference the account's security identifier (SID) rather than its name, so a new account created with the same name gets a new SID and none of the old access. Deprovisioning is the whole process, with each of those steps at the right time plus session revocation and cleanup outside the directory. If a departed employee's phone keeps syncing mail after the account is disabled, the missing step is revoking sessions and tokens, not disabling the account again.
Deprovisioning on the CompTIA Security+ exam
Provisioning and deprovisioning user accounts are part of SY0-801 objective 4.5, a scenario objective on identity and access management. Wording such as "a terminated employee's credentials were used weeks later," "contractor accounts remain active after the project ended," "an employee who changed departments can still open the old team's share" or "tie account removal to HR records" points to deprovisioning. Choose disabling over deleting when the account must be preserved for an investigation. Distractors include password expiration, which does nothing about a session that is already open, and account lockout, which only reacts to failed logons.