This enhancement is brought to you by
Idea GOV-I-880
Description
We’ve made it easier to ensure that access is fully and automatically revoked when an identity is terminated, across all sources. This has been one of the top customer requests with 320+ votes in the Ideas Portal. The new enhancements reduce reliance on complex rules and manual updates, saving time and minimizing risk.
This post outlines the new capabilities available for Lifecycle State configuration, including access removal, smarter source selection, and auditing.
New Capabilities
Admins can now:
- Choose “Remove All Access” when a user hits a termination state, revoking all requested and detected access.
- Automatically bypass approval flows for access removal during termination.
- Audit and trace access revocations tied to Lifecycle State changes.
- Use a new out-of-the-box LCS for faster onboarding of new identity profiles.
- Select “All Sources” for enable/disable account actions, ensuring new sources are automatically included.
- Exclude specific sources from All Sources logic (e.g. skip Workday).
Problem
When a user is terminated, two critical things need to happen:
- Accounts must be disabled on all connected sources.
- Access must be removed across roles, access profiles, and entitlements.
Currently, these actions are handled in a somewhat fragmented and manual way.
For account disablement, administrators configure Lifecycle States to define which sources should be included. However, as new sources are added over time, these configurations aren’t always updated, meaning some accounts may remain active after a user leaves.
For access removal, admins put significant effort into managing both requested and detected access. Some implement BeforeProvisioning rules to remove entitlements, while others use access certifications to review and revoke access after the fact—often introducing delays due to approval requirements.
While these methods are functional, they can be inconsistent and difficult to maintain at scale, potentially creating audit gaps and increasing risk exposure over time.
Solution
Admins can now configure Lifecycle States to automatically remove all access from terminated users without relying on rules or manual certifications. When “Remove All Access” is selected, the system will revoke all requested access items, including roles, access profiles, and entitlements, along with detected entitlements and associated access profiles. Approvals for these revocations are bypassed, ensuring fast and consistent deprovisioning. Access provisioned by the current Lifecycle State or birthright roles will not be removed.
This option can be found under:
Admin → Identity Management → Identity Profiles → [Select Identity Profile] → Lifecycle Management
We’ve also introduced a new All Sources option, allowing admins to enable or disable actions across all sources, including newly onboarded ones, without needing to update the configuration each time. Admins can exclude specific sources if needed, maintaining control while automating the bulk of the work.
In addition, admins can now select IdentityNow/ISC as a source when configuring account enablement and disablement.
Who is affected?
All Identity Security Cloud customers.
Action Required
No immediate action is required. However, to take advantage of the new capabilities, we recommend reviewing your current Lifecycle State configurations under:
Admin → Identity Management → Identity Profiles → [Select Identity Profile] → Lifecycle Management
From there, you can:
- Enable Remove All Access
- Use the All Sources option for account disablement or enablement
- Include IdentityNow as a selectable source
Important Dates
- Beta Rollout: June 16, 2025
- Sandbox Rollout: June 23, 2025
- Production Rollout (All Customers): The week of June 30th
