Key takeaway
Tie the identity inventory to business workflows: record the owner, purpose, access approver and deprovisioning condition up front.
Create a source of record and assign owners
Define which system is the source of record for human, contractor, service, device and emergency identities. Record the business and technical owner, purpose, approved resources and expiry. A person may appear under different names in multiple directories; reconcile identifiers and investigate duplicates or orphaned accounts. A central directory provides visibility, but application-specific permissions may still need separate review.
Govern role and access changes
At onboarding, grant minimum permissions for the approved role. When a person changes job, team or contract, remove permissions no longer required for the new role and separately approve new needs so access does not accumulate. Set an expiry for temporary access and verify automatic removal. Recertify access to sensitive systems periodically; managers should clarify unfamiliar permissions with system owners rather than approve blindly.
Verify deprovisioning and exceptions
Prepare a checklist for departure, contract end, lost device and compromise covering accounts, tokens, keys, sessions and group membership. Record an owner, reason and expiry for exceptions; close overdue exceptions unless they are approved again. Measure process delays and test coordination between HR, helpdesk, cloud and application owners.
Receive an authorized trigger
Verify authorization for the departure or incident trigger and preserve required data.
Disable accounts
Disable directory and application accounts within the approved scope; account for groups and local permissions.
Revoke sessions and credentials
Revoke supported sessions and tokens and replace affected credentials.
Verify every target
Verify effective loss of access and document residual expiry and failed connectors. Close exceptions only when they are not reapproved.
Identity for remote and mobile work
Remote employees, contractors and mobile devices access applications outside the office network, so identity should not rely on corporate network connectivity alone. Coordinate a central identity provider, federated sign-in, MFA, device enrollment and application-level role decisions. Govern new and personal devices with suitable policies, collect only necessary sign-in data, and revoke sessions and tokens when a device is lost.