Key Takeaways
- Deprovisioning removes or deactivates accounts, permissions, and licenses of people who are no longer authorized.
- Triggers include departure, role change, project completion, or the end of an external engagement.
- Germany's BSI requires in ORP.4.A2 that unneeded accounts be removed when personnel changes occur.
- Forgotten accounts remain a security risk and continue to incur license costs.
How does deprovisioning work?
Deprovisioning starts with the departure date and ends with the documented revocation of all access. Typical steps:
- Record the departure or role change in the HR system.
- Identify all accounts, devices, and licenses held by the person.
- Disable accounts, hand over data, and release or cancel licenses.
- Document every step with person and timestamp.
Why is deprovisioning important for small and medium-sized businesses?
Deprovisioning closes accounts that would otherwise remain open after a departure. Small and medium-sized businesses often lack a central list of all applications in use because teams adopt tools on their own. If an account stays active, a former employee can continue accessing customer data and the license keeps being paid for. Accounts outside Single Sign-On are the ones most frequently overlooked.
What types of deprovisioning exist?
There is manual and automated deprovisioning.
- Manual: The administrator of each application disables or deletes the account themselves.
- Automated: A source system deactivates accounts in connected applications, for example via SCIM.
- Hybrid: Connected applications are handled automatically, while all others are processed via tasks assigned to responsible owners.
Example: Deprovisioning in practice
Example: An agency with 60 employees parts ways with a project manager. He used 14 applications, 9 of them via Single Sign-On. Disabling his account in the identity provider ends SSO login, while the tool admins individually disable the remaining 5 accounts that have their own passwords. Without a list, an account in the project tool costing 12 euros a month would have remained open.
Deprovisioning vs. IT Offboarding
| Aspect | Deprovisioning | IT Offboarding |
|---|---|---|
| Scope | Accounts, permissions, and licenses | Access, devices, data, handovers, and documentation |
| Trigger | Departure, role change, project end | Departure from the company |
| Participants | IT and tool admins | HR, IT, manager, Finance, and tool admins |
| Result | No active access remaining | Fully completed departure |
Deprovisioning is the sub-step of IT offboarding that removes accounts and permissions, whereas offboarding additionally covers devices, data, and handovers.
How does Sovaro help with Deprovisioning?
Sovaro deliberately orchestrates departures: a departure in Personio, Google Workspace, or Microsoft Entra starts the workflow, all known access rights and devices land on a return checklist, and tasks go to the responsible tool admins. The team decides when an account is disabled, for example if emails need to keep running for a few weeks. Sovaro does not require admin access to every tool, and every step is recorded in the audit log.