An audit finds that terminated employees keep active accounts in several SaaS applications for weeks after leaving, because each application owner removes users manually whenever a ticket eventually arrives. Which control best fixes the root cause?
Select an answer to reveal the explanation.
Short Explanation
If every app owner has to remember to lock the door, someone always forgets. Automated deprovisioning from the identity provider gives you one master switch: HR marks the leaver, and every connected app shuts the account. Quarterly reviews are nice, but they're a detective control that finds the problem months late.
Full Explanation
The root cause is a manual, per-application deprovisioning process that depends on tickets reaching each owner. Lifecycle automation centralizes that decision in the identity provider: the HR system of record signals a status change, the IdP disables the identity, and a provisioning protocol such as SCIM (System for Cross-domain Identity Management) pushes account deactivation to every connected SaaS application within minutes. The same mechanism creates and updates accounts, so joiners and movers are handled consistently. Quarterly access reviews are a valuable detective control, but they discover orphaned accounts up to three months after the fact and still rely on manual removal, so the exposure window remains. Shortening session timeouts ends existing sessions sooner, yet the account and its credentials still exist and the former employee can simply sign in again. Monthly password rotation is disruptive for current users, does not remove the account, and does nothing for accounts reached through federation or API tokens. Exam caveat: where an application supports federation only, disabling the user at the IdP blocks new sign-ins, but SCIM is still needed to remove the dormant account and its stored data entitlements. Operational check: terminate a test identity in the HR system and confirm that its accounts in each connected SaaS application are deactivated automatically, with the event recorded in the IdP's provisioning logs.