Identity and Access Management: Lifecycle, Provisioning, and Access Reviews

Identity and access management is the set of processes that decide who exists in your systems, what they may do, and when that stops being true. It is less glamorous than most security work and it is where a large share of breaches actually begin — through an account that should have been disabled, or one with permissions nobody could justify.

The four pillars

Identification is the claim: this is who I am. Authentication is proving it. Authorization is what that proven identity may do. Accounting is the record of what it did.

Exam questions often hinge on separating authentication from authorization. A user who signs in successfully and then gets a permission error has authenticated and failed authorization — two different systems, two different fixes.

The lifecycle

Joiner. An account is created with the access appropriate to the role, ideally driven automatically from the HR system so the authoritative source of "who works here" is the system that knows. Manual provisioning from email requests is where phantom accounts come from.

Mover. The failure point. When someone changes role, new access is granted promptly because they need it to work, and old access is removed slowly or never, because nobody is inconvenienced by it remaining. Repeat over several years and a long-tenured employee accumulates permissions spanning three departments — privilege creep, and it is the single most common finding in access audits.

The fix is to treat a role change as a leave-and-rejoin: revoke everything tied to the old role, then grant the new role's access, rather than adding to what is there.

Leaver. Access must be removed at the moment of departure, and for an involuntary departure, before the conversation happens. Orphaned accounts are attractive precisely because nobody is watching them — no one notices unusual activity on an account whose owner left eighteen months ago. Cover everything, not just the directory: SaaS applications outside single sign-on, service accounts the person owned, shared credentials they knew, VPN certificates, and physical badges.

Access models

RBAC assigns permissions to roles and users to roles. It scales well and is easy to audit, and its weakness is role explosion — enough exceptions and you end up with more roles than people.

ABAC evaluates attributes at request time: department, location, device state, time of day, data classification. Far more expressive, and considerably harder to reason about when someone asks why access was denied.

DAC lets resource owners decide, which is how file shares typically work and why they drift toward everyone having access. MAC enforces system-wide policy that owners cannot override.

Whichever model, least privilege is the governing principle, and separation of duties splits sensitive operations so no single account can complete a high-risk action alone.

Reviews and certification

Access accumulates unless something removes it, and periodic review is that something. Managers or data owners are presented with their people's current access and must confirm or revoke — quarterly for privileged and sensitive access, at least annually for the rest.

Reviews fail in a predictable way: presented with a long list, reviewers approve everything. Make them meaningful by reviewing by exception, highlighting access that differs from the person's peers, has not been used in ninety days, or was granted outside the standard role. A short list of anomalies gets real attention; a hundred-line list gets a signature.

Track unused access as a metric in its own right. Permissions granted and never exercised are pure risk with no offsetting benefit.

Where the technology fits

Single sign-on centralizes authentication so users have one credential and you have one place to enforce policy and to revoke — disabling the identity should end access everywhere, which only holds if applications genuinely federate rather than keeping local passwords. That consolidation is the argument for federation protocols.

Multi-factor authentication protects the authentication step, and the strength depends on which factors are combined; phishing-resistant options such as FIDO2 and passkeys are the current target state for anything privileged.

Administrative accounts need their own treatment — vaulted credentials, just-in-time elevation, session recording — covered under privileged access management. And identity governance tooling automates joiner-mover-leaver and the review cycle, which is what makes any of this survive at scale.

Exam angles

Separate identification, authentication, authorization, and accounting. Know the joiner-mover-leaver lifecycle and privilege creep as the classic mover failure. Compare RBAC, ABAC, DAC, and MAC, and apply least privilege and separation of duties. Recognize orphaned accounts and stale privileged access as findings, and periodic access review as the control. When a scenario describes a departed employee still able to sign in, the gap is deprovisioning, not authentication.