Key Takeaways
- Provisioning creates accounts and permissions in target applications and keeps their attributes up to date.
- Typical triggers are onboarding, role changes, or the rollout of a new application.
- Automated provisioning frequently uses SCIM under RFC 7643 and RFC 7644.
- Provisioning is not authentication: SSO requires an account that already exists.
How does user provisioning work?
User provisioning transfers identity data from a source of truth into target applications and creates accounts with appropriate permissions there. The source system is usually an HR system or a directory service such as Microsoft Entra ID or Google Workspace. The process has three steps:
- An event such as a new hire or role change is recorded.
- Accounts, groups, and licenses are created or modified in the target applications.
- Attributes such as department or manager are updated when changes occur.
What types of user provisioning exist?
There is manual, semi-automated, and automated provisioning.
- Manual: An administrator creates each account directly in the application.
- Semi-automated: A workflow generates tasks or requests that responsible owners complete.
- Automated: A source system transfers accounts directly via SCIM or a vendor API.
Why is user provisioning important for small and medium-sized businesses?
Clean provisioning ensures that new employees are ready to work on day one and receive only the permissions they need. Without a defined process, waiting times, forgotten accounts, and doubly paid licenses arise. Since many SaaS applications only offer SCIM on expensive tiers, part of provisioning in smaller companies remains manual and requires clear responsibilities.
Example: User Provisioning in practice
Example: A software company with 45 employees hires a sales representative. She needs 7 applications. Microsoft 365 and the CRM create her account automatically via SCIM, while the respective tool admins create the remaining 5 accounts within 2 days before her start date. Because the CRM has no free license left, Finance approves an additional seat.
User Provisioning vs. Single Sign-On (SSO)
| Aspect | User Provisioning | Single Sign-On (SSO) |
|---|---|---|
| Purpose | Create account and permissions in the application | Log in via a central identity |
| Timing | Before first use and upon changes | At every login |
| Typical standard | SCIM | SAML or OpenID Connect |
| Result | User account with attributes and license | Authenticated session for the user |
User provisioning ensures that an account exists, whereas Single Sign-On ensures that the person can log in to it using their central identity.
How does Sovaro help with User Provisioning?
Sovaro is not a SCIM provisioner and does not create accounts via SCIM itself. A new hire in Personio, Google Workspace, or Microsoft Entra starts a workflow in Sovaro: access is requested from the respective tool admin, and if a license is missing, Finance approves it. Every step is recorded with person and timestamp in the audit log.