Tutorial 5: Access Reviews and Identity Lifecycle

Unit 3 ยท Identity and access management

Objectives

Identity governance covers creation, changes, suspension, deletion, ownership, and periodic review. A mover event is as important as a leaver event: old permissions must not accumulate when responsibilities change. Reviews need an accountable owner, current resource context, evidence of use, and a recorded decision.

join -> baseline access -> approve exceptions
move -> recalculate access -> remove obsolete grants
leave -> disable identity -> revoke sessions and keys

Automate deterministic lifecycle actions, but preserve human approval for sensitive exceptions. Reconcile identity sources with target systems and alert on orphaned accounts, dormant credentials, privilege spikes, and failed deprovisioning.

Exercises

  1. Design lifecycle events for an employee and contractor.
  2. Create an access-review evidence checklist.
  3. Choose three identity metrics.

Self-check

  1. What is a mover event?
  2. Why review service accounts?
  3. What is an orphaned account?

Self-Check Quiz

1. Why is deprovisioning time important?

AnswerIt limits the window in which a departed or changed identity can use obsolete access.

2. What is access recertification?

AnswerAn accountable review confirming that permissions remain appropriate for a person, service, or resource.

Homework

  1. Build a quarterly access-review process.
  2. Define exceptions and escalation rules.
  3. Report stale accounts, excessive permissions, and review completion.
Sample answerA good process assigns resource owners, supplies current permission and usage evidence, requires approve/revoke decisions, escalates overdue reviews, and measures time to deprovision, dormant identities, privileged accounts, and revoked grants.