Automating Provisioning and De-provisioning

Manual access management does not scale. When your organisation has 10 people, managing user accounts by hand is feasible. When you have 50, 200, or 1,000 — and each person needs access to multiple systems — manual processes become slow, error-prone, and dangerous. Automating provisioning (granting access) and de-provisioning (revoking access) is how mature organisations ensure the right people have the right access at the right time, without relying on someone remembering to raise a ticket.

This lesson explains what provisioning automation looks like, why it matters for security, and how to start — even if your organisation does not have an enterprise IT budget.

What Is Provisioning and De-provisioning?

Provisioning is the process of creating user accounts, assigning roles, and granting access to the systems a person needs when they join or change roles. De-provisioning is the reverse — removing access and disabling accounts when someone leaves, changes role, or no longer needs access to a system.

In most organisations today, these processes are manual:

• HR tells IT that a new employee is starting on Monday
• IT creates accounts in each system one at a time
• Someone copies permissions from a colleague in the same role
• When the employee leaves, HR sends another email — sometimes days or weeks later
• IT disables accounts — sometimes missing one or two systems

Every step in this manual chain is an opportunity for error, delay, and security exposure.

The Security Case for Automation

Automation is not just about efficiency — it is a security imperative. Consider the de-provisioning problem:

When an employee is terminated for cause (e.g., misconduct, data theft suspicion), their access needs to be revoked immediately — ideally within minutes, not days. A manual process that depends on HR emailing IT, who then logs into each system individually, creates a dangerous window during which a disgruntled former employee can exfiltrate data, sabotage systems, or cause harm.

The same principle applies to role changes. If someone moves from finance to marketing and their finance system access is not promptly revoked, they retain access to financial data they no longer need — a violation of least privilege and a potential insider risk.

Research by the Ponemon Institute found that the average time to de-provision a departing employee is 116 hours — nearly five full business days. During that window, the former employee’s credentials remain active and exploitable.

What Automation Looks Like in Practice

Provisioning automation does not require complex enterprise software (though it can use it). At its core, automation means establishing triggers and workflows that connect HR events to access changes:

Trigger-Based Provisioning

• New hire recorded in HR system → automatically create accounts in email, collaboration tools, and role-specific applications based on the assigned role
• Role change recorded in HR system → automatically adjust permissions (add new role permissions, revoke old role permissions)
• Departure recorded in HR system → automatically disable all accounts across all connected systems within a defined timeframe (e.g., within 1 hour of the recorded departure time)

Levels of Automation Maturity

Not every organisation needs — or can immediately implement — full automation. Think of it as a maturity journey:

• Level 1 — Documented manual process: Written checklists for provisioning and de-provisioning. IT follows the same steps every time. This is better than ad-hoc but still relies on human execution.
• Level 2 — Semi-automated: Some steps are automated (e.g., Microsoft 365 account creation from a template), but others remain manual. HR notifies IT through a ticketing system with defined SLAs.
• Level 3 — Fully automated: HR events trigger automatic provisioning and de-provisioning across all connected systems. Manual intervention is only needed for exceptions. Full audit logging is automatic.

Most small and mid-sized organisations should aim for Level 2 as a realistic near-term target, with a roadmap toward Level 3 as systems and budget allow.

Starting Points for Small Organisations

You do not need an enterprise identity governance platform to begin automating. Practical starting points include:

• Microsoft 365 / Google Workspace templates: Create user templates for each role that pre-configure group memberships, application access, and security settings. New accounts are created from the template rather than by copying another user.
• Scripted provisioning: A simple script (PowerShell for Microsoft environments, Google Apps Script for Google) that creates accounts across multiple systems from a single input form.
• Ticketing system integration: Use your IT ticketing system to create standardised onboarding and offboarding tickets with mandatory checklists. Tickets are triggered by HR and tracked to completion.
• Calendar-based automation: Schedule de-provisioning in advance. If a contractor’s engagement ends on March 31st, set up the account to disable automatically at 18:00 on that date.

The De-provisioning Checklist

Whether automated or manual, every de-provisioning event should cover:

1. Disable the primary account (e.g., Microsoft 365 / Google Workspace) — this often cascades to connected services
2. Revoke access to all business applications — CRM, finance software, project tools, etc.
3. Remove VPN and remote access credentials
4. Revoke access to physical premises — key cards, building access codes
5. Transfer ownership of files, shared drives, and mailboxes to the departing person’s manager
6. Recover company devices — laptops, phones, tokens
7. Change shared passwords if the person had access to any (another reason to eliminate shared accounts)
8. Document everything — record what was revoked, when, and by whom

Why This Matters

The gap between an employee’s last day and the revocation of their access is one of the most exploited windows in cybersecurity. Former employees with active credentials have caused some of the most damaging insider breaches on record. Automated de-provisioning closes this window to minutes instead of days.

On the provisioning side, automation ensures that new employees start with the correct access from day one — no more waiting three days for IT to set up their accounts, and no more inheriting inappropriate permissions from copied user profiles.

From a compliance standpoint, automated provisioning and de-provisioning provides a complete, timestamped audit trail of every access change — exactly what regulators and auditors require.

What to Do Now

• Document your current provisioning and de-provisioning processes — even if they are entirely manual
• Measure how long it currently takes to fully de-provision a departing employee across all systems
• Create a standardised onboarding checklist and offboarding checklist if one does not exist
• Identify one or two systems where template-based or script-based provisioning could replace manual account creation
• Work with HR to ensure that departure dates are communicated to IT before the employee’s last day, not after

Evidence to Collect

• Documented provisioning and de-provisioning procedures (even if manual)
• Evidence of timely de-provisioning — records showing accounts were disabled within the defined timeframe of departure
• Onboarding and offboarding checklists showing completion for recent starters and leavers
• Logs or tickets demonstrating that access changes are tracked and auditable

Common Mistakes

• Relying on HR to remember to notify IT. The process should be systematic, not dependent on someone remembering to send an email. Integrate with your HR system or ticketing platform.
• De-provisioning the email account but forgetting other systems. A departing employee may have access to 10+ systems. Disabling their email is only one step. Use a checklist to ensure nothing is missed.
• Not testing the de-provisioning process. Run a test: pick a recent leaver and verify that all their access has actually been revoked. Many organisations discover gaps when they check.
• Treating provisioning automation as an “enterprise only” capability. Even a well-structured spreadsheet with checklists and templates is a form of automation. Start where you are and improve incrementally.

---

Knowledge Check

---