In an EMU environment using SCIM, what is the expected outcome when a user is deprovisioned in the identity provider?
Select an answer to reveal the explanation.
Short Explanation
When the IdP says someone's gone, SCIM should make GitHub reflect that by suspending or removing the managed user's access. That's the point of lifecycle automation, and it stops them from acting under the enterprise identity. Audit history stays for investigations, so you don't wipe the person from history or turn them into a personal account.
Full Explanation
The expected outcome is that SCIM deprovisioning suspends or removes the managed user's access according to GitHub's EMU lifecycle. EMU plus SCIM is designed so identity joiners, movers, and leavers in the identity provider drive GitHub account state. The idea that the user retains full write access indefinitely for compliance reasons defeats offboarding security. The idea that the user is converted into an unmanaged personal account with the same repositories misstates EMU boundaries; deprovisioning is not a conversion to a personal account that keeps the same managed footprint as a security outcome. The idea that all enterprise audit logs are wiped for that user is false and would harm investigations; audit records are retained per product retention and are not erased by SCIM offboarding. Operational check: validate deprovisioning in a pilot group, measure the delay between identity-provider disable and GitHub suspension, and have a manual emergency revoke path for tokens and sessions.