<!-- Copyright (c) 2026 defconxt. All rights reserved. -->
<!-- Licensed under AGPL-3.0 — see LICENSE file for details. -->
<!-- NERF is a trademark of defconxt. -->
---
name: implementing-identity-lifecycle-automation
description: >-
  Automate identity lifecycle management including joiner/mover/leaver (JML)
  workflows, SCIM provisioning, access certification campaigns, and role-based
  access control automation across identity providers.
domain: cybersecurity
subdomain: identity-security
tags:
  - identity-lifecycle
  - scim
  - jml-workflows
  - provisioning
  - access-certification
version: "1.0"
author: defconxt
license: AGPL-3.0
metadata:
  mitre-attack:
  - T1078
  - T1098
  - T1136
  - T1087
---

# Implementing Identity Lifecycle Automation

## Overview

Identity lifecycle automation ensures that user accounts, access rights, and
group memberships are provisioned, modified, and deprovisioned in alignment
with HR events and organizational changes. SCIM provides the protocol layer,
while JML workflows define the business logic.

## Prerequisites

| Requirement | Purpose |
|---|---|
| Python 3.10+ | Agent tooling |
| SIEM access | Log correlation |
| IdP API access | Identity provider queries |
| `pip install msal` | Microsoft auth library |
| `pip install okta` | Okta SDK |

## Key Concepts

### JML Workflow Stages

```
JOINER                    MOVER                     LEAVER
├── Create account        ├── Update department      ├── Disable account
├── Assign base role      ├── Revoke old access      ├── Revoke all access
├── Provision apps        ├── Grant new access       ├── Transfer data
├── Enroll MFA            ├── Update group membership├── Archive mailbox
├── Send welcome email    ├── Recertify access       ├── Delete after retention
└── Start probation timer └── Notify managers        └── Audit trail
```

### SCIM Protocol

| Operation | Method | Endpoint | Description |
|---|---|---|---|
| Create | `POST` | `/Users` | Provision new user |
| Read | `GET` | `/Users/{id}` | Get user details |
| Update | `PATCH` | `/Users/{id}` | Modify user attributes |
| Delete | `DELETE` | `/Users/{id}` | Deprovision user |
| Search | `GET` | `/Users?filter=...` | Find users |
| Bulk | `POST` | `/Bulk` | Batch operations |

## Workflow

```
1. MAP        — Document current JML processes and pain points
2. DESIGN     — Define automated JML workflows and approval chains
3. CONFIGURE  — Set up SCIM provisioning between IdP and target apps
4. IMPLEMENT  — Build automation for joiner, mover, and leaver events
5. TEST       — Validate end-to-end lifecycle flows
6. CERTIFY    — Run access certification campaigns
7. MONITOR    — Track provisioning success rates and exceptions
```

## Verification

```bash
# Validate agent script
python3 -m py_compile scripts/agent.js && echo "OK" || echo "FAIL"
ruff check scripts/agent.js

# Run agent help
node scripts/agent.js --help
```

## References

- [MITRE ATT&CK — Identity Techniques](https://attack.mitre.org/tactics/TA0006/)
- [NIST SP 800-63 Digital Identity Guidelines](https://pages.nist.gov/800-63-3/)
- [NIST SP 800-207 Zero Trust Architecture](https://csrc.nist.gov/publications/detail/sp/800-207/final)
- [CIS Controls v8](https://www.cisecurity.org/controls/v8)
