--- id: CP-205 slug: scim-automated-provisioning-offboarding lang: en title: SCIM and automated account provisioning description: How SCIM creates, changes and disables application accounts when you join, change roles or leave, and what you need to do. canonical_url: https://startbrain.io/cyberpedia/en/articles/scim-automated-provisioning-offboarding/ markdown_url: https://startbrain.io/cyberpedia/en/articles/scim-automated-provisioning-offboarding.md publisher: Brain (https://startbrain.io) license: CC BY 4.0 (https://creativecommons.org/licenses/by/4.0/) cite_as: Brain, "SCIM and automated account provisioning", Cyberpedia, 2026. https://startbrain.io/cyberpedia/en/articles/scim-automated-provisioning-offboarding/ (CC BY 4.0) wing: 3 theme: control_access reflex: cr-028 schema: G3 updated: "2026-11-03" translations: en: https://startbrain.io/cyberpedia/en/articles/scim-automated-provisioning-offboarding/ fr: https://startbrain.io/cyberpedia/fr/articles/scim-provisionnement-automatique-departs/ de: https://startbrain.io/cyberpedia/de/articles/scim-automatische-bereitstellung-austritte/ es: https://startbrain.io/cyberpedia/es/articles/scim-aprovisionamiento-automatico-bajas/ sources: - "n": 1 title: What is app provisioning in Microsoft Entra ID? publisher: Microsoft url: https://learn.microsoft.com/en-us/entra/identity/app-provisioning/user-provisioning accessed: "2026-11-03" - "n": 2 title: How Application Provisioning works in Microsoft Entra ID publisher: Microsoft url: https://learn.microsoft.com/en-us/entra/identity/app-provisioning/how-provisioning-works accessed: "2026-11-03" - "n": 3 title: Known issues for provisioning in Microsoft Entra ID publisher: Microsoft url: https://learn.microsoft.com/en-us/entra/identity/app-provisioning/known-issues accessed: "2026-11-03" - "n": 4 title: User Account Management, Mitigation M1018 - Enterprise | MITRE ATT&CK® publisher: MITRE ATT&CK url: https://attack.mitre.org/mitigations/M1018/ accessed: "2026-11-03" - "n": 5 title: "Valid Accounts: Cloud Accounts, Sub-technique T1078.004 - Enterprise | MITRE ATT&CK®" publisher: MITRE ATT&CK url: https://attack.mitre.org/techniques/T1078/004/ accessed: "2026-11-03" - "n": 6 title: Session Management - OWASP Cheat Sheet Series publisher: OWASP url: https://cheatsheetseries.owasp.org/cheatsheets/Session_Management_Cheat_Sheet.html accessed: "2026-11-03" - "n": 7 title: Require Multifactor Authentication | CISA publisher: CISA url: https://www.cisa.gov/audiences/small-and-medium-businesses/secure-your-business/require-multifactor-authentication accessed: "2026-11-03" --- # SCIM and automated account provisioning In a company, every employee has accounts in many applications: email, file storage and other tools. When someone joins, changes roles or leaves, those accounts have to be created, changed or closed. If closing is done by hand, it can be forgotten, and the account of a person who has left then stays open. SCIM (System for Cross-domain Identity Management) is a specification that gives applications a common way to receive these operations from the company directory [1]. This article explains what SCIM automates, what it does not cover, and what the employee and their manager must do for the process to work. ## In 30 seconds - Where it happens: at every arrival, role change or departure, in all the applications linked to the company directory. - What the attacker wants: to use a forgotten account that nobody watches, in order to get into the systems. - The reflex: give notice of the arrival, role change or departure in good time, create no account outside the official process, and hand back all your access. - If it is already done: if you opened an account outside the process or kept an access after changing roles, report it to the IT team so that it is linked to the process or closed. ## Straight answers ### What is SCIM, in practice? It is a common language between the directory and the applications. Without it, each application has its own access addresses, its own way of describing a user and its own data schema. SCIM provides a common user schema to bring people in, take them out and move them between applications [1]. The Microsoft Entra ID provisioning service connects to the SCIM 2.0 endpoint provided by the application vendor to create, modify and delete users [2]. ### What does the directory change for a departure? The directory becomes the source of truth. Automated provisioning includes creating accounts, but also maintaining them and removing them when status or role changes [1]. It can automatically disable accounts in the right applications when people leave the team or the organization [1]. It also keeps accounts up to date according to changes in the directory or in the human resources system [1]. ### How does this reduce ghost accounts? Because closing no longer depends on someone's memory. Microsoft lists among the motivations the immediate removal of identities from key SaaS applications when a person leaves [1]. When a person falls out of the provisioning scope, including when they are removed from the application, the service disables their account in the target application [2]. This assumes, however, that the application is connected, which the pitfalls below detail. ### What is my role, if everything is automatic? The automation starts from the directory. If the directory does not know that you are leaving or changing department, nothing is triggered. The information must reach it in time, and it is the employee and their manager who trigger it. ## How it works The provisioning service works in cycles. An initial cycle queries all the users and groups of the source, then incremental cycles process only what has changed since the last saved marker [2]. If a user has no matching account in the application, one is created. If they have one, it is updated [2]. Departure follows several planned cases. A user who is disabled or deleted into the "recycle bin" in the directory is disabled in the target application. For a SCIM application, disabling amounts to asking for the "active" property to be false [2]. Thirty days after deletion in the directory, the user is permanently deleted, and the service then sends a deletion request to the application [2]. A user whose groups or rights change can also fall out of scope, which counts as a departure from the application [2]. With dynamic groups, the speed of removal depends on how fast the group re-evaluates its members [2]. Everything is recorded in the provisioning logs, which keep track of the reads and writes made on the source and target systems [2]. ## What you do - Give notice in advance. Tell your manager and human resources about your arrival, role change or departure with the exact date, because it is the change in the directory that triggers everything else. - Managers: report role changes as you do departures. A change of role may require removing access, not only adding it [1]. - Create no account outside the official process: no personal sign-up to a service with your work address, no account opened by hand in an application's administration interface without informing the IT team. Such an account is not linked to the directory, so nobody will close it automatically. - Hand back your access before leaving: badge, security keys, devices, and any access you received through a channel other than your usual account. - Turn on multi-factor authentication on the accounts that stay open. CISA ranks security keys first among the methods and SMS or email codes last [7]. ## Pitfalls ### Application not connected An application in the catalog supports either manual provisioning or automatic provisioning. In manual mode, there is no automatic connector: accounts are created by hand, for example in the application's administration portal or through a spreadsheet file [1]. For these applications, departure goes through a human action. An application created from a simple OIDC registration is not enabled for automatic provisioning [3]. ### Changes made directly in the application The service ignores changes made in external applications and does not undo them: it relies on what changes in the directory [3]. An account created or modified locally therefore escapes the process. Microsoft states that provisioning can also detect existing accounts in an application, including local or orphaned ones [1]. MITRE recommends removing orphaned accounts, for example those without an owner, during regular audits, and automatically disabling accounts after a period of inactivity, for example 30 days [4]. ### Local accounts, shared accounts, passwords Password provisioning is not supported [3]. Some on-premises applications are not federated with the directory and require local passwords [3]. A shared account or a local password known to someone who is leaving does not close with the departure of its holder: it has to be changed or deleted by hand. ### Delays and errors The interval between two cycles is not configurable [3]. When an error prevents a user from being modified, the operation is retried at the next cycle, and an administrator must consult the logs to find the cause [2]. If most calls fail, for example because of invalid administration credentials, the job goes into quarantine, with cycles slowed to one per day, then it is disabled after more than four weeks [2]. A departure may therefore not be carried through in time without anyone noticing. ### Tokens and sessions that survive According to MITRE, an attacker who controls a cloud account can create additional long-lived credentials to stay in it, and these credentials can bypass controls such as multi-factor authentication [5]. The sources cited here do not say whether an open session stops as soon as a SCIM account is disabled. On the application side, OWASP states that, when a session ends, the application must invalidate it on the client side and the server side, and that the server side is the most important and mandatory from a security point of view [6]. It also recommends an idle timeout and an absolute timeout for all sessions [6]. When an employee leaves, the IT team must therefore check access tokens, application passwords and sessions, in addition to the account itself. ## Sources 1. Microsoft, "What is app provisioning in Microsoft Entra ID?". https://learn.microsoft.com/en-us/entra/identity/app-provisioning/user-provisioning (accessed 3 November 2026) 2. Microsoft, "How Application Provisioning works in Microsoft Entra ID". https://learn.microsoft.com/en-us/entra/identity/app-provisioning/how-provisioning-works (accessed 3 November 2026) 3. Microsoft, "Known issues for provisioning in Microsoft Entra ID". https://learn.microsoft.com/en-us/entra/identity/app-provisioning/known-issues (accessed 3 November 2026) 4. MITRE ATT&CK, "User Account Management, Mitigation M1018 - Enterprise | MITRE ATT&CK®". https://attack.mitre.org/mitigations/M1018/ (accessed 3 November 2026) 5. MITRE ATT&CK, "Valid Accounts: Cloud Accounts, Sub-technique T1078.004 - Enterprise | MITRE ATT&CK®". https://attack.mitre.org/techniques/T1078/004/ (accessed 3 November 2026) 6. OWASP, "Session Management - OWASP Cheat Sheet Series". https://cheatsheetseries.owasp.org/cheatsheets/Session_Management_Cheat_Sheet.html (accessed 3 November 2026) 7. CISA, "Require Multifactor Authentication | CISA". https://www.cisa.gov/audiences/small-and-medium-businesses/secure-your-business/require-multifactor-authentication (accessed 3 November 2026) --- Original source: Cyberpedia, the public cybersecurity and AI encyclopedia published by Brain. Canonical version: https://startbrain.io/cyberpedia/en/articles/scim-automated-provisioning-offboarding/ You may reuse this text freely under the CC BY 4.0 license (https://creativecommons.org/licenses/by/4.0/), provided you credit "Brain, Cyberpedia" with a link to the canonical URL above.