What Is User Provisioning? How SCIM Automates It

Short answer: User provisioning is the identity management process that creates, updates and removes user accounts and access rights in the applications people need for their job. Automated user provisioning does this from a single source of truth, usually an identity provider or HR system, through a standard such as SCIM, so access follows the person's status instead of a ticket queue.

How user provisioning works

User provisioning follows the employee lifecycle, often called joiner, mover, leaver. A new hire (joiner) needs accounts in email, chat, the ticketing system and a handful of SaaS apps. A role change (mover) adds some access and should remove the rest. A departure (leaver) should disable everything on the last day.

In an automated setup, one system is authoritative and everything else follows it:

1. Source of truth changes. HR creates the worker record, or an admin adds the user to a group in the identity provider (Entra ID, Okta, Google Workspace).
2. Scoping decides who gets what. Group assignments or attribute rules (department, location, job code) decide which apps the user is in scope for.
3. Matching avoids duplicates. The provisioning service looks for an existing account in the target app using a matching attribute, such as the user principal name mapped to the app's userName.
4. Create or update. If no match exists, the service creates the account with mapped attributes; if one exists, it updates it.
5. Remove when out of scope. When the user leaves the group, is disabled or is deleted, the service disables or deletes the target account.

Microsoft documents exactly this sequence for its Entra provisioning service, including a stored watermark so each incremental cycle only processes changes since the last run.

Why user provisioning matters for IT teams

User provisioning matters because every account that outlives its owner is an open door. A former employee's SaaS login, a contractor account nobody disabled, or a mover who kept finance access after switching teams are all access that no longer has a business reason.

Manual provisioning makes those gaps likely. Microsoft's own overview of app provisioning describes manually creating accounts or uploading CSV files each week as "time-consuming, expensive, and error prone."

There is also a compliance angle. NIST SP 800-53 Revision 5, control AC-2 (Account Management), asks organizations to "create, enable, modify, disable, and remove accounts" according to defined policy, to notify account managers when users are terminated or transferred, and to "align account management processes with personnel termination and transfer processes" (AC-2 text). Automated provisioning with logs is the easiest way to show an auditor that this happens every time, not only when someone remembers.

Manual, JIT and SCIM provisioning compared

There are three common ways to get accounts into an application, and they differ most on what happens when someone leaves.

Watch out: SSO blocks sign-in through the identity provider, but an account created by JIT can still hold API tokens, shared links or local credentials. Pair SSO with SCIM or a documented manual removal step.

Entra ID supports all four patterns: SCIM for SaaS, plus LDAP, SQL, REST, SOAP and PowerShell connectors through an on-premises agent.

What deprovisioned means: disable vs delete

Deprovisioned means a user's account has been disabled or removed in a system because the person no longer needs access. In practice, most automated deprovisioning disables first and deletes later.

Microsoft's documentation spells out the difference: a disable generally means the user cannot sign in, and a delete means the user is removed from the application entirely. For SCIM apps, a disable is a request that sets the user's active property to false (Microsoft Learn).

Events that trigger a disable in Entra ID include:

• Unassignment: the user is removed from the app or from its assigned group.
• Scope change: the user no longer passes an attribute scoping filter.
• Soft delete: the user is deleted or blocked from sign-in in Entra ID.

The hard delete arrives later. Entra ID permanently deletes users 30 days after a soft delete, and only then sends a DELETE request to the app, unless an admin permanently deletes the user sooner. Disable-first is deliberate: it lets you restore a user deleted by mistake and preserves data for legal hold.

Common misconceptions about user provisioning

• "SSO means provisioning is handled." SSO controls how people sign in. Provisioning controls whether an account exists. Microsoft pairs the two: SAML or OIDC for sign-in, SCIM for accounts.
• "Automated means instant." Sync runs in cycles. If a provisioning job fails repeatedly, Entra ID puts it in quarantine and slows cycles to once per day, and disables the job after four weeks (Microsoft Learn).
• "Every group assignment flows through." Entra ID's provisioning service cannot read users in nested groups; only direct members of an assigned group are provisioned.
• "Deprovisioned means deleted." Usually it means disabled, with deletion weeks later or never.

Admin tip: Check the provisioning logs, not just the app's user list. Entra ID records every read and write the service makes, including why a user failed to create.

User provisioning in practice

Three common situations show where automation helps and where it stops:

• A 60-person company on Microsoft 365 can assign SaaS apps to security groups in Entra ID and turn on SCIM for apps in the gallery. Group-based assignment requires Entra ID P1 or P2, according to Microsoft's scoping documentation.
• A company with an HR system can make HR the source of truth, so a hire date creates the directory account and a termination date disables it. Entra ID documents this "inbound" flow for Workday and SuccessFactors.
• A same-day termination still needs a runbook: disable the identity provider account, revoke sessions, then let provisioning finish removing app accounts on its next cycle.

For password vaults specifically, tying access to the identity provider is one of the controls covered in are password managers safe for business use.

What to look for in user provisioning software

User provisioning software is usually part of an identity provider or an identity governance product rather than a standalone tool. When you compare options, check:

• SCIM coverage for your actual apps, not the total number of integrations advertised.
• Deprovisioning behavior: disable vs delete, and whether you can configure it per app.
• HR-driven provisioning if HR, not IT, knows first when someone joins or leaves.
• Connectors for on-prem apps (LDAP, SQL, PowerShell) if you still run them.
• Logs and alerts you can hand to an auditor.
• Plan gating: some SaaS vendors only offer SCIM on their top plan, which changes the real cost of automation.

The identity and access management category hub lists the vendors this site covers, and the shortlist builder turns these checks into a scored comparison.

Bottom line

If you are creating accounts by hand in more than a few apps, start with offboarding, not onboarding: list which apps support SCIM, turn it on for the ones holding sensitive data, and write a manual removal step for the rest. The answer changes if your SaaS vendors only offer SCIM on an enterprise plan, which is a cost question worth settling before renewal. Compare identity providers that handle provisioning in the identity and access management category.