SCIM deactivation is only the first step in removing access. A safe deprovisioning workflow must propagate the state change to local memberships, browser sessions, OAuth grants, cached decisions, background jobs, and shared resources within a measured deadline.
Define the trigger precisely
SCIM represents users as resources and supports updating their attributes. The SCIM protocol specification defines PATCH and PUT operations and the behavior clients and service providers use to change resources. Your contract must state what an inactive user means locally: blocked interactive authentication, removed group-derived authorization, stopped token refresh, and no new delegated work.
Handle repeated and out-of-order events. Directory syncs retry, administrators can reactivate a user, and multiple identity providers may describe the same person. Store the directory object ID, tenant, source version or timestamp, desired state, and last applied transition. A delayed “active” update must not undo a newer suspension.
Revoke every access path
Start with local group and role mappings. Mark the identity inactive before removing memberships so a partial failure fails safely. Authorization checks should reject an inactive subject even if a stale relationship remains.
Terminate browser sessions and revoke refresh tokens or grants. The OAuth token revocation standard explains that revocation can invalidate a token and, depending on policy, related tokens or the underlying grant. Self-contained access tokens may remain valid until expiry unless services receive an additional revocation signal, so token lifetime and cache TTL form part of the deprovisioning objective.
Invalidate decision caches, API gateway sessions, WebSockets, device sessions, and signed download links. A cached “member of finance” answer can preserve access after the source membership is gone. Every positive cache needs an upper bound or an event-driven eviction path.
Background jobs need their own contract. Cancel unstarted jobs created with the user’s authority. Reauthorize each sensitive batch of an active job, or run it under a narrow tenant-owned identity when the work is meant to survive employee departure. Do not leave exported archives available through a link that outlives the user.
Preserve shared resources safely
Deprovisioning should not delete team-owned documents or orphan approvals. Transfer ownership according to tenant policy, preserve immutable audit history, and remove personal sharing links. If a resource has only one owner, route it to an administrator queue before finishing the transition.
Personal API credentials, SSH keys, application passwords, and webhook secrets may sit outside the primary session store. Maintain an inventory of credential types and a revocation adapter for each. New credential features must join this registry before launch.
Make delay and failure visible
Define an objective such as: “Within 60 seconds of accepting an inactive SCIM update, 99.9 percent of access paths reject new operations; no path exceeds five minutes.” Measure from accepted directory event to probes at the gateway and representative services.
Model deprovisioning as a durable state machine. Each adapter reports pending, complete, retryable failure, or terminal investigation. Retry infrastructure errors with idempotency keys. A malformed tenant mapping should enter a visible dead-letter state and page the identity owner; returning success while silently skipping the user is dangerous.
Audit the source event, resolved local identity, previous and new state, memberships removed, credentials revoked, jobs stopped, resource transfers, latency, and failures. Avoid storing token material.
Include a manual emergency path for compromised accounts when the directory is unavailable. It should use strong operator authentication, record justification, revoke local access immediately, and reconcile with the directory when service returns.
Run a quarterly synthetic deprovisioning: create a test employee with a group grant, browser session, API grant, open socket, queued export, and shared document; deactivate through SCIM; measure each path. The first practical step is to list every credential and cache that can authorize a request after the directory record changes.
Sources are linked throughout this guide. Product capabilities can change; consult the linked documentation for your deployment.
Read our editorial approach ↗