Deprovisioned

Deprovisioned is a term used in information technology and security to describe the state of a user, device, or service that no longer has access to systems, data, or resources. It is the counterpart to provisioning and is a key part of identity and asset lifecycle management.

In practice, deprovisioning refers to the process of revoking access and removing entitlements when someone leaves an organization, changes role, or when a device is retired. It typically involves disabling accounts, revoking credentials (passwords, tokens, MFA), removing group memberships, and reclaiming hardware or software licenses. Data handling may include archiving, transferring, or securely erasing user data according to policy.

In identity and access management, deprovisioning is usually automated through offboarding workflows connected to HR or asset management systems, with clear ownership, accountability, and audit trails. Standards and interfaces such as SCIM or APIs enable cross-system deprovisioning across cloud applications and on-premises systems.

Risks and challenges associated with deprovisioning include the possibility of dormant or orphaned accounts, elevated security risk, noncompliance, and wasted licensing. Best practices emphasize automated, policy-driven workflows; immediate or timely deactivation after termination or role change; use of centralized identity providers; regular access reviews; and comprehensive logging and retention of deprovisioning actions.

See also: Provisioning; Offboarding; Identity management; Access governance.