Time to deprovision: measuring how fast leavers lose access

ILM Reference editors · Published 2026-05-26 · 2 minute read

TRACK: RUNNING THE PROGRAM · LESSON 10 OF 11

SUMMARYREV. 2026-09

Time to deprovision is the time between a leaver's termination date in the HR system and the moment each of their accounts is disabled. Measure it per application, not per person, because connected applications are usually fast and disconnected ones are not. Report the share of leavers within your policy window and the slowest applications.

§ 01

What exactly do you measure?

Two timestamps per account. The start is the termination effective date and time in the HR system. The end is the time the account was disabled or removed in the application itself, not the time a ticket was raised. For connected applications the end timestamp comes from the provisioning log; for disconnected ones it comes from the ticket closure or the application's own audit log.

Leaver metrics to report.
Metric	How to calculate	Why it matters
Within policy	Share of leaver accounts disabled within your policy window	The number an auditor tests against
Median time	Middle value of time to deprovision, per application	Shows the normal speed
Slowest	Longest time in the period, per application	Shows the exceptions
Missed	Leaver accounts still active at the next reconciliation	These are orphan accounts

§ 02

Which controls ask for it?

NIST SP 800-53 control AC-2 asks organizations to notify account managers when users are terminated or transferred (item h), to align account management with personnel termination and transfer processes (item l), and, in enhancement AC-2(3), to disable accounts within a defined period when they are no longer associated with a user. DORA's technical standard, Delegated Regulation (EU) 2024/1774, requires access rights to be withdrawn when employment ends. See the AC-2 lesson and the DORA lesson.

§ 03

Where does time get lost?

The HR record arrives late. A termination entered after the last day means every downstream clock starts late.
Disconnected applications wait for a ticket queue. The account stays active until someone works the ticket.
Local accounts are missed entirely. Disabling the directory account does not disable an account stored inside the application.
Active sessions continue. Disabling an account does not always end sessions already open; the Shared Signals note covers session revocation.

§ 04

What have vendors added?

Microsoft's Entra what's new page lists prefetching Workday termination data to customize account disable logic as generally available in April 2026. C1 says its lifecycle product can find what offboarding missed, and Lumos says leavers are fully offboarded with licenses reclaimed. None of these measures the disconnected applications for you; the metric still needs the application-side timestamp.