Orphan accounts linger because HR terminations never reliably reach IT. Which automation use case best addresses this?
Select an answer to reveal the explanation.
Short Explanation
Hook HR's hire and fire events straight into account create/disable jobs so orphan logins stop collecting dust. Automation beats Friday reminder emails every time.
Full Explanation
Orphan accounts linger when HR terminations never reliably reach IT identity systems. Automating user provisioning and de-provisioning from HR join/move/leave events closes that gap: hire creates or enables accounts with correct roles, moves adjust entitlements, and terminations disable access quickly without depending on informal reminders. For municipalities, HR-driven identity automation is one of the highest-value security operations automations because leftover accounts are a predictable, recurring risk.
Manually emailing a volunteer each Friday hoping they remember leavers is brittle and routinely misses same-day terminations. Disabling automation in favor of hallway conversations institutionalizes missed offboarding. Granting terminated users thirty extra days of full access as a courtesy intentionally extends unauthorized access after employment ends.
Exam caveat: automation must handle exceptions (contractors, emergency workers, leave without pay) with defined workflows, and disables should preserve audit history per retention rules. Bad HR data will automate bad access—so validate authoritative sources.
Operational check: integrate the HRIS join/move/leave feed with the IdP/AD provisioning pipeline, measure disable latency after termination effective time, periodically hunt for active accounts with terminated HR status, and alert when feed jobs fail.