What it means
Account deprovisioning removes or disables access, sessions, credentials, tokens, groups, roles, and recovery methods when access is no longer authorized.
Why it matters
Incomplete deprovisioning creates orphaned access that can remain usable long after a person, service, or relationship changes.
Practical focus
- Trigger deprovisioning from authoritative lifecycle events
- Revoke active sessions and credentials
- Remove downstream and federated access
- Verify completion and investigate failures
Common mistakes
- Disabling only the directory account
- Waiting for a periodic review after termination
- Ignoring shared, local, and service accounts
- Deleting records before preserving needed evidence
Certification relevance
This subject appears in or supports the following certification bodies of knowledge: