deprovisioning

Deprovisioning is the process of revoking access rights, removing permissions, and disabling or terminating accounts and services for an individual or device when authorization ends. It is the counterpart to provisioning, which grants access and resources. Proper deprovisioning reduces the risk of unauthorized access, data leakage, and unused licenses, and helps ensure compliance with privacy and security policies when employees leave, change roles, or contractors conclude their assignments.

The workflow typically begins with a trigger from human resources, a manager, or an automated policy. Identity and access management (IAM) systems execute a sequence that disables login capabilities, revokes group memberships and licenses, revokes API tokens, and removes access to applications. In many organizations, devices are reclaimed or wiped, and data is migrated, archived, or deleted according to retention policies. Access reviews and audit trails support verification.

In cloud environments, deprovisioning often includes disabling SSO, revoking OAuth tokens, deactivating user accounts across SaaS services, and revoking access to data stores. In on-premises contexts, it may involve disabling VPN access, removing access to file shares, and ensuring that backups do not contain active permissions for the former user.

Key considerations include privacy and data handling, data retention, device return, and third-party services. Common challenges are delays, dependencies on other systems, and handling of special cases such as contractors or dormant accounts. Best practices emphasize automation, standardized offboarding checklists, least privilege access, periodic access reviews, and maintaining auditable records.

Metrics such as time to deprovision and completion rate help measure effectiveness. Deprovisioning is an ongoing governance activity tied to provisioning, identity management, and compliance programs.