Deprovisioning is the teardown half of identity lifecycle: removing access, memberships, and licenses when a person leaves, changes roles, or a project ends. Provisioning gets automated because people complain about missing access; deprovisioning stays incomplete because nobody complains about keeping it.
Why deprovisioning stays incomplete#
Disabling an account is one operation; unwinding a directory presence is many: direct memberships, licensed group memberships, ownerships that need transfer, and any structure where the identity is load bearing. Each remainder is invisible until an audit or an incident finds it.
Role changes are the worst case: the person remains active, so nothing forces cleanup, and the old role's memberships persist alongside the new one's indefinitely.
VisualizerEngine
Deprovisioning with VisualizerEngine
Structural search enumerates an identity's full directory presence, direct memberships, licensed groups, and ownerships, which is the checklist deprovisioning needs. Snapshot diffs prove the teardown completed, and saved searches catch the disabled-but-still-membered accounts that slipped through.