Day 13

What is the key difference between an approval flow and a provisioning workflow?

An approval flow decides whether access should be granted, while a provisioning workflow actually carries out that decision by creating the account and access, similar to a manager approving a work order versus the factory floor building the product.

Why do provisioning workflows matter compared to manual account creation?

Manual account creation can take IT staff days to complete one system at a time, while automated provisioning workflows can create the same accounts in minutes, letting new employees become productive almost immediately.

What are the four building blocks of a provisioning workflow?

Trigger (the event that starts the process), Steps (the ordered actions performed), Target Systems (where accounts actually get created), and Confirmation (the permanent record proving access was successfully created).

Can you walk through the four stages of the provisioning lifecycle?

Request (the initial trigger, like a new hire being added), Evaluation (checking the request against company rules and possibly routing it through an approval flow), Execution (SailPoint actually creating accounts and configuring systems), and Confirmation (recording exactly what was done, when, and for whom).

How would you define birthright access, and what analogy is used to explain it?

Birthright access is the access every employee automatically receives the moment they join, without asking for it, similar to a "starter kit" of uniform, ID badge, and building key handed to a new hire on day one.

How is birthright access typically determined?

It's usually based on simple facts about the employee, such as department, job title, or work location, with SailPoint using those facts to automatically calculate what starter access a new person should receive.

What is the difference between birthright access and requested access?

Birthright access is automatic and comes bundled with the job from day one, while requested access must be specifically asked for by the employee or their manager, usually through an approval flow.

What role do connectors play in automated provisioning?

A connector is the piece of software that lets SailPoint communicate directly with another system, translating instructions so SailPoint can actually create real accounts inside each different target system.

What is a rules engine, and how does it support automated provisioning?

The rules engine is the part of SailPoint that decides exactly what access someone should receive using "if this, then that" logic, ensuring the same consistent decision is made every time instead of relying on memory or guesswork.

Why does automated provisioning scale well during busy hiring periods?

It can handle one request or ten thousand requests with the same speed and consistency, since an automated process doesn't get tired or slow down as volume increases, unlike manual account creation.

How does automated provisioning reduce human error?

It follows the exact same steps every single time, avoiding the typos, missed systems, and inconsistent permissions that happen when people manually set up accounts by hand.

What is deprovisioning, and how does it relate to provisioning?

Deprovisioning is the exact opposite of provisioning, taking access away instead of granting it, similar to collecting back every key that was previously handed out.

What is the "strict checklist" analogy used to describe deprovisioning?

Deprovisioning is compared to the strict checklist an HR manager follows when someone leaves (badge collected, laptop returned, every account disabled), automated so nothing gets accidentally skipped, even during a busy moment.

What's the difference between immediate and scheduled deprovisioning?

Immediate deprovisioning happens right away, often for a sudden termination requiring instant access cutoff, while scheduled deprovisioning happens on a set future date, often for a planned resignation with a known last day.

Why does speed matter so much in deprovisioning?

Every extra hour a former employee's access remains active is unnecessary security risk, similar to leaving a house key with someone who no longer lives there, so automated deprovisioning closes that window of risk as quickly as possible.

What are the common triggers that can kick off a deprovisioning workflow?

Resignation (voluntary departure), termination (involuntary departure), and role change (where certain access must be removed even though the person still works there).

How do provisioning and deprovisioning work together as a "full circle"?

Provisioning grants access at the right moments, like joining or changing roles, while deprovisioning removes access at the right moments, like leaving or no longer needing something, together ensuring each person has exactly the access they need, nothing more or less.

What is one common pitfall companies fall into with birthright access?

Granting overly broad birthright access "just in case," which quietly increases unnecessary risk instead of keeping starter access limited to what's genuinely needed.

Why is relying on manual, memory-based offboarding considered a significant pitfall?

People forget steps, especially during busy or emotional times, which is exactly the kind of gap automated, checklist-driven deprovisioning is designed to close.

What is considered a best practice for keeping provisioning and deprovisioning workflows reliable?

Always connecting them directly to the HR system so they trigger automatically and reliably, and regularly reviewing and testing the workflows to make sure they still match current company policy.