In an EMU environment using SCIM, what is the expected outcome when a user is deprovisioned in the identity provider?
Select an answer to reveal the explanation.
Short Explanation and Infographic
When IdP says someone is gone, SCIM should make GitHub reflect that — suspend/remove the managed user so they stop committing under enterprise identity. That is the whole point of lifecycle automation. Audit history should remain for investigations; you do not wipe the person from history, and you do not silently turn them into a personal account keeping the same managed footprint.
Full explanation below image
Full Explanation
The correct answer is that SCIM deprovisioning suspends or removes the managed user's access per EMU lifecycle rules. EMU plus SCIM is designed so identity joiners/movers/leavers in the IdP drive GitHub account state. Option A defeats offboarding security. Option B misstates EMU boundaries; deprovisioning is not convert to personal and keep everything as-is as a security outcome. Option C is false and would harm investigations; audit records are retained per product retention, not erased by SCIM offboarding. Validate deprovisioning in a pilot group, measure delay between IdP disable and GitHub suspension, and have a manual emergency revoke path for tokens and sessions.