Each of a company's twelve cloud accounts has its own locally created administrator and user identities with separate passwords. Offboarding often misses some accounts, leaving former employees with access. Which change best addresses the root cause?

The root cause is identity sprawl: separate local identities in each account create twelve independent lifecycles that must each be updated when someone joins, moves or leaves. Federating the accounts with the enterprise identity provider, using standards such as SAML or OpenID Connect, makes the IdP the single authoritative source. Users authenticate once with corporate credentials and MFA, receive roles in each account based on group membership, and lose access everywhere as soon as their corporate identity is disabled, which ties cloud access to the HR-driven joiner, mover and leaver process. Stronger passwords and rotation improve credential quality but do nothing when offboarding simply forgets to delete the identity; a former employee with a valid password still gets in. A quarterly reconciliation script is a detective control that finds orphaned identities up to three months late and still relies on manual cleanup. Consolidating workloads into a single account sacrifices the isolation that multiple accounts provide, enlarging the blast radius of any compromise, and still leaves local identities to manage. Exam caveat: federation also reduces password reuse and centralizes MFA enforcement. Operational check: disable a test user in the identity provider and confirm sign-in fails across all twelve accounts, and that no local human users remain.