Key takeaway
Document the exact tasks covered, systems and data the provider can access, and who owns approval and escalation.
Define service boundaries and ownership
Clarify whether the service covers account creation and removal, role changes, MFA, access reviews, monitoring and incident response. Assign responsibility to the customer, provider and identity system for each step. Name the decision owner and approval path for urgent account restriction and employee departure. Base expectations on the actual agreement, not broad promotional statements about contracts or SLAs.
| Activity | Customer decision | Provider task to agree |
|---|---|---|
| Access policy and approval | Resource owner approves | Implement scoped change |
| Incident containment | Authorize actions and escalation | Investigate and execute only agreed actions |
| Access review | Owner confirms ongoing need | Collect evidence and track revocation |
| Service exit | Customer controls offboarding/data requirements | Remove provider access and hand over evidence |
Minimize provider access
Define when provider staff may access user and admin accounts, how they authenticate and how sessions are logged. Require individual accounts, MFA, limited roles, approval, expiry and separation of duties. Use customer-controlled just-in-time access where available. Assess support-system access, data storage, subcontractors and credential revocation when the contract ends.
Measure outcomes and incident readiness
Agree on reporting for timely account removal, discovery and revocation of excess access, approval delays, MFA coverage and open exceptions. Metrics should reflect the actual service scope; do not assume outcomes such as “complete protection.” Rehearse together who receives an identity incident alert, how evidence is shared, who disables accounts and tokens, and how service is restored.
Core IAM operating duties
IAM commonly synchronizes identity stores, creates, changes and disables accounts and groups, authenticates users and services, grants role-based permissions and supports access review. SAML and OIDC support federated sign-in; SCIM or supported connectors/APIs can create, update and disable application accounts. Availability depends on the application and tenant configuration; successful SSO integration does not prove deprovisioning. Plan human approvals, exceptions and departure processes alongside the technical automation.