Cyberpediaby Brain
ENDEFR

SCIM and automated account provisioning

How SCIM creates, changes and disables application accounts when you join, change roles or leave, and what you need to do.

In 30 seconds

Where it happens
At every arrival, role change or departure, in all the applications linked to the company directory.
What the attacker wants
To use a forgotten account that nobody watches, in order to get into the systems.
The reflex
Give notice of the arrival, role change or departure in good time, create no account outside the official process, and hand back all your access.
If it is already done
If you opened an account outside the process or kept an access after changing roles, report it to the IT team so that it is linked to the process or closed.

What it is

In a company, every employee has accounts in many applications: email, file storage and other tools. When someone joins, changes roles or leaves, those accounts have to be created, changed or closed. If closing is done by hand, it can be forgotten, and the account of a person who has left then stays open.

SCIM (System for Cross-domain Identity Management) is a specification that gives applications a common way to receive these operations from the company directory1. This article explains what SCIM automates, what it does not cover, and what the employee and their manager must do for the process to work.

Straight answers

What is SCIM, in practice?

It is a common language between the directory and the applications. Without it, each application has its own access addresses, its own way of describing a user and its own data schema. SCIM provides a common user schema to bring people in, take them out and move them between applications1. The Microsoft Entra ID provisioning service connects to the SCIM 2.0 endpoint provided by the application vendor to create, modify and delete users2.

What does the directory change for a departure?

The directory becomes the source of truth. Automated provisioning includes creating accounts, but also maintaining them and removing them when status or role changes1. It can automatically disable accounts in the right applications when people leave the team or the organization1. It also keeps accounts up to date according to changes in the directory or in the human resources system1.

How does this reduce ghost accounts?

Because closing no longer depends on someone's memory. Microsoft lists among the motivations the immediate removal of identities from key SaaS applications when a person leaves1. When a person falls out of the provisioning scope, including when they are removed from the application, the service disables their account in the target application2. This assumes, however, that the application is connected, which the pitfalls below detail.

What is my role, if everything is automatic?

The automation starts from the directory. If the directory does not know that you are leaving or changing department, nothing is triggered. The information must reach it in time, and it is the employee and their manager who trigger it.

1How it works1 min

The provisioning service works in cycles. An initial cycle queries all the users and groups of the source, then incremental cycles process only what has changed since the last saved marker2. If a user has no matching account in the application, one is created. If they have one, it is updated2.

Departure follows several planned cases. A user who is disabled or deleted into the "recycle bin" in the directory is disabled in the target application. For a SCIM application, disabling amounts to asking for the "active" property to be false2. Thirty days after deletion in the directory, the user is permanently deleted, and the service then sends a deletion request to the application2. A user whose groups or rights change can also fall out of scope, which counts as a departure from the application2. With dynamic groups, the speed of removal depends on how fast the group re-evaluates its members2.

Everything is recorded in the provisioning logs, which keep track of the reads and writes made on the source and target systems2.

2What you do1 min
  • Give notice in advance. Tell your manager and human resources about your arrival, role change or departure with the exact date, because it is the change in the directory that triggers everything else.
  • Managers: report role changes as you do departures. A change of role may require removing access, not only adding it1.
  • Create no account outside the official process: no personal sign-up to a service with your work address, no account opened by hand in an application's administration interface without informing the IT team. Such an account is not linked to the directory, so nobody will close it automatically.
  • Hand back your access before leaving: badge, security keys, devices, and any access you received through a channel other than your usual account.
  • Turn on multi-factor authentication on the accounts that stay open. CISA ranks security keys first among the methods and SMS or email codes last7.
3Pitfalls2 min

Application not connected

An application in the catalog supports either manual provisioning or automatic provisioning. In manual mode, there is no automatic connector: accounts are created by hand, for example in the application's administration portal or through a spreadsheet file1. For these applications, departure goes through a human action. An application created from a simple OIDC registration is not enabled for automatic provisioning3.

Changes made directly in the application

The service ignores changes made in external applications and does not undo them: it relies on what changes in the directory3. An account created or modified locally therefore escapes the process. Microsoft states that provisioning can also detect existing accounts in an application, including local or orphaned ones1. MITRE recommends removing orphaned accounts, for example those without an owner, during regular audits, and automatically disabling accounts after a period of inactivity, for example 30 days4.

Local accounts, shared accounts, passwords

Password provisioning is not supported3. Some on-premises applications are not federated with the directory and require local passwords3. A shared account or a local password known to someone who is leaving does not close with the departure of its holder: it has to be changed or deleted by hand.

Delays and errors

The interval between two cycles is not configurable3. When an error prevents a user from being modified, the operation is retried at the next cycle, and an administrator must consult the logs to find the cause2. If most calls fail, for example because of invalid administration credentials, the job goes into quarantine, with cycles slowed to one per day, then it is disabled after more than four weeks2. A departure may therefore not be carried through in time without anyone noticing.

Tokens and sessions that survive

According to MITRE, an attacker who controls a cloud account can create additional long-lived credentials to stay in it, and these credentials can bypass controls such as multi-factor authentication5. The sources cited here do not say whether an open session stops as soon as a SCIM account is disabled. On the application side, OWASP states that, when a session ends, the application must invalidate it on the client side and the server side, and that the server side is the most important and mandatory from a security point of view6. It also recommends an idle timeout and an absolute timeout for all sessions6. When an employee leaves, the IT team must therefore check access tokens, application passwords and sessions, in addition to the account itself.

Fact sheet

Identifier
CP-205
Wing
3. Protocols and defence
Brain skill
Controlling Access (control_access)
Brain reflex
cr-028
Diagram
G3 · System & Protocol Anatomy
Languages
de, en, fr
Sources
7 sources checked on 3 November 2026
Sources7 sources
  1. Microsoft, “What is app provisioning in Microsoft Entra ID?”. https://learn.microsoft.com/en-us/entra/identity/app-provisioning/user-provisioning (accessed 3 November 2026)
  2. Microsoft, “How Application Provisioning works in Microsoft Entra ID”. https://learn.microsoft.com/en-us/entra/identity/app-provisioning/how-provisioning-works (accessed 3 November 2026)
  3. Microsoft, “Known issues for provisioning in Microsoft Entra ID”. https://learn.microsoft.com/en-us/entra/identity/app-provisioning/known-issues (accessed 3 November 2026)
  4. MITRE ATT&CK, “User Account Management, Mitigation M1018 - Enterprise | MITRE ATT&CK®”. https://attack.mitre.org/mitigations/M1018/ (accessed 3 November 2026)
  5. MITRE ATT&CK, “Valid Accounts: Cloud Accounts, Sub-technique T1078.004 - Enterprise | MITRE ATT&CK®”. https://attack.mitre.org/techniques/T1078/004/ (accessed 3 November 2026)
  6. OWASP, “Session Management - OWASP Cheat Sheet Series”. https://cheatsheetseries.owasp.org/cheatsheets/Session_Management_Cheat_Sheet.html (accessed 3 November 2026)
  7. CISA, “Require Multifactor Authentication | CISA”. https://www.cisa.gov/audiences/small-and-medium-businesses/secure-your-business/require-multifactor-authentication (accessed 3 November 2026)

Cite this article

Brain, “SCIM and automated account provisioning”, Cyberpedia, 2026. https://startbrain.io/cyberpedia/en/articles/scim-automated-provisioning-offboarding/

BibTeX 
@misc{brain_cp205_en_2026,
  author = {Brain},
  title = {SCIM and automated account provisioning},
  year = {2026},
  howpublished = {Cyberpedia},
  url = {https://startbrain.io/cyberpedia/en/articles/scim-automated-provisioning-offboarding/},
  note = {CC BY 4.0}
}
CC BY 4.0 licence