*Updated 4 November 2026 by Simon Mestdagh, founder of Caspian.*

**Key takeaways**

- Deprovisioning removes a person's accounts and access, one system at a time.
- Offboarding is the whole leaver process: laptop, handover, access and evidence.
- A company with 60 SaaS apps deprovisions a leaver up to 60 times.
- Deprovisioning starts with a disable and ends with a delete after a retention period.
- SSO controls sign-in only; an account can outlive a blocked SSO login.

Deprovisioning removes a person's accounts and access in each system. Offboarding is the whole leaver process, and deprovisioning is one part of it. Offboarding also covers the laptop, the handover of files and channels, and the evidence that access is gone.

Caspian publishes this page and sells a product in this space: Caspian, the IT automation platform for scale-ups. Facts were checked on 4 November 2026.

## What do offboarding and deprovisioning mean?

**Offboarding.** The full process a company runs when a person leaves. HR closes the contract, the manager names who inherits the person's work, and IT gets the laptop back, removes access in every app, and keeps a record. Offboarding is finished when every step has an owner's sign-off and evidence.

**Deprovisioning.** Disabling or removing a person's account and access in one system at a time. A company with 60 SaaS apps deprovisions a leaver up to 60 times. Deprovisioning usually starts with a disable, so the person cannot sign in, and ends with a delete after a retention period.

**Provisioning.** The reverse: creating a person's account and access in each system they need. Microsoft says automatic provisioning "includes the maintenance and removal of user identities as status or roles change" ([Microsoft Learn, checked 4 November 2026](https://learn.microsoft.com/en-us/entra/identity/app-provisioning/user-provisioning)).

**SCIM.** An open standard (RFC 7644) that lets an identity provider create, update, disable and delete accounts in an app over an API ([IETF](https://datatracker.ietf.org/doc/html/rfc7644)). It is one way to deprovision, in apps that support it.

## How do deprovisioning and offboarding differ?

Offboarding is the whole leaver process, owned by HR, the manager and IT, and it covers the laptop and the handover. Deprovisioning covers accounts and access only, one system at a time, and it is done when each app reads back disabled or removed.

| | Offboarding | Deprovisioning |
| --- | --- | --- |
| Scope | The whole leaver process | Accounts and access, one system at a time |
| Owner | HR, the manager and IT | IT, or an automated tool |
| Covers the laptop | Yes: return, lock, wipe | No |
| Covers file and channel handover | Yes | Only as a step before delete |
| Typical tools | HR system, checklist, MDM | Identity provider, SCIM, admin consoles |
| Done when | Every step is signed off | Each app reads back disabled or removed |

## What does account deprovisioning mean?

Account deprovisioning means making an account unusable for the person who left, in a specific app. In practice that is three actions: block sign-in, end the sessions that are already open, and revoke the credentials that act as the person, such as API tokens and OAuth grants.

The third action is the one most often missed. A suspended Google Workspace or Entra account stops new sign-ins through single sign-on. A personal API token created in that app keeps working until someone revokes it, because the token does not ask the identity provider for permission. The same holds for accounts that use their own password instead of single sign-on.

Deprovisioning is per app, so the work grows with the app count. The hard part is often the list, not the click: knowing every app where the person had an account, including the ones they signed up for themselves with a work email.

## Should you deprovision or delete an account?

Deprovisioning usually starts with a disable, not a delete. Microsoft's provisioning service "supports both deleting and disabling (sometimes referred to as soft-deleting) users". A disable generally means "the user can't sign in"; a delete means the user "has been removed completely from the application" ([Microsoft Learn, checked 4 November 2026](https://learn.microsoft.com/en-us/entra/identity/app-provisioning/how-provisioning-works)).

The order protects data. Disable first, hand over what the person owned, then delete after the retention period. In Google Workspace an admin can restore a deleted user for up to 20 days, and data that was not transferred is gone after that ([Google Workspace Admin Help, checked 4 November 2026](https://knowledge.workspace.google.com/admin/users/delete-or-remove-a-user-from-your-organization)). A disabled account can come back if HR got the date wrong. A deleted one usually cannot.

## Is SSO the same as user provisioning?

Single sign-on (SSO) decides how a person signs in: the app asks the identity provider whether the person may enter. Provisioning decides whether an account exists in the app at all. The two are separate.

That gap is why SSO alone does not deprovision. When IT suspends a user in the identity provider, SSO stops the next sign-in. The account in the app still exists, still holds a paid seat, and may still accept a password or a token. Provisioning, through SCIM or another route, is what removes or disables that account.

A company can have SSO without provisioning, which is common, or provisioning without SSO. The cleanest setup uses both: SSO for sign-in, provisioning for the account's life from joiner to leaver. For apps without either, IT does the work by hand in the admin console.

## Can you automate deprovisioning without SCIM?

SCIM handles the account step of deprovisioning, in apps that support it on the plan you pay for. With SCIM, a disable is a request that sets the user's `active` property to false, and a delete is an HTTP DELETE on the user ([Microsoft Learn, checked 4 November 2026](https://learn.microsoft.com/en-us/entra/identity/app-provisioning/how-provisioning-works)). Vendors often keep SCIM on top plans: Slack offers it on Business+ and Enterprise Grid ([Slack help](https://slack.com/help/articles/212572638)), Notion on Enterprise only ([Notion help](https://www.notion.com/help/provision-users-and-groups-with-scim)), both checked 4 November 2026.

SCIM does not cover the rest of offboarding: the laptop, the channels and repos the person owned, or apps without SCIM. For those apps, IT opens each admin console by hand. Caspian removes that step. It deprovisions through the app's API, SCIM or an auditable browser script, reads each app back to confirm the account is disabled, and asks a person to approve every removal. It costs €10 per active user per month, excluding VAT. [Start for free](/start). The full leaver list is in the [IT offboarding checklist template](/resources/it-offboarding-checklist-template).

## What does Caspian read, and with which rights?

Caspian reads metadata and settings, not content. It reads which apps exist, who has an account, which role that account has, and the state of each laptop. It does not read file contents, email bodies or chat messages. Connections are read-only by default; Caspian asks for write rights only for the steps you switch on, such as removing a leaver's account. Customer data is stored with AWS in the EU (Frankfurt). An independent pen test is planned, and ISO 27001 and SOC 2 are in progress.

*Simon Mestdagh, founder of Caspian, wrote this page. We make Caspian, one of the tools discussed here.*

## FAQ

### What is the difference between deprovisioning and offboarding?

Offboarding is the whole process when someone leaves. Deprovisioning is the part that disables or removes their accounts and access in each system.

### Is deprovisioning the same as deleting an account?

No. Deprovisioning usually disables the account first, so the person cannot sign in. The delete comes after files and owned items have moved.

### What is SCIM deprovisioning?

An identity provider using the SCIM standard to disable or delete a user in an app. A disable sets the user's active property to false; a delete removes the user.

### Does suspending a user in Google Workspace or Entra deprovision them everywhere?

No. It blocks sign-in through that identity provider. Accounts with their own password, open sessions and API tokens stay until someone removes them.

### Is SSO enough to remove a leaver's access?

No. SSO controls sign-in. The account, the paid seat and any tokens stay in the app until it is deprovisioned.