Identity Lifecycle and SCIM
Identity lifecycle management connects joining, changing jobs, and leaving with changes to access. The video starts onboarding from a human resources record and assigns standard role-based, or birthright, access. Okta and Microsoft Entra appear as examples, not recommendations. Source: IAM Ecosystem Explained (13:26-14:59).
Provision and Verify
SCIM means System for Cross-domain Identity Management. It can create, update, and deactivate accounts in compatible software-as-a-service applications. Applications without compatible support need connectors or manual handling. Check that the requested changes actually reached each application; issuing a provisioning request is not enough. Source: IAM Ecosystem Explained (13:26-14:59).
Handle Movers and Leavers
In the hypothetical Sarah scenario, moving from support to payments adds new permissions without removing old ones. This produces privilege creep: access accumulates beyond the current job’s needs. A role change must therefore consider removals as well as additions. Source: IAM Ecosystem Explained (14:59-15:40).
Disabling the identity provider account or mailbox does not prove that access has ended. Local application accounts, existing sessions, and tokens may remain usable. Terminate sessions and revoke tokens where supported, disable remaining accounts, and verify the result. The alternative ending illustrates verified local-account removal preventing a later attack; it is not a measured breach outcome. Source: IAM Ecosystem Explained (15:40-16:36; 27:09-27:53).