Chris Noth has recently joined CloudAppSec Private Ltd. as a cloud security engineer. Owing to several instances of malicious activities performed by…

SCIM (System for Cross-domain Identity Management) is an open standard protocol specifically designed to automate the exchange of user identity information between different systems. Its primary purpose is to simplify and automate user provisioning and de-provisioning. By implementing SCIM, an organization can automatically create, update, and delete user accounts across various cloud services as employees join, change roles, or leave. This directly addresses the requirement to automate user lifecycle management and mitigate risks from lingering accounts of former employees.

B. XACML is an access control policy language. It defines authorization rules ("what a user can do"), not the lifecycle management of user accounts.
C. OpenID is an authentication protocol. It is used to verify a user's identity (i.e., log them in), not to manage their account lifecycle.
D. OAuth is an authorization framework. It is used to grant applications limited access to user data without sharing credentials, not for user provisioning.

1. Internet Engineering Task Force (IETF), RFC 7643, "System for Cross-domain Identity Management: Core Schema", Section 1. This document defines the SCIM standard, stating its purpose is to "reduce the cost and complexity of user management operations by providing a common user schema and extension model, as well as binding documents to provide patterns for exchanging this schema using existing protocols."

2. Internet Engineering Task Force (IETF), RFC 7644, "System for Cross-domain Identity Management: Protocol", Section 1. This RFC specifies the protocol for managing identities, explicitly covering create, modify, and delete operations, which are the core of provisioning and de-provisioning.

3. University of California, Berkeley, "Identity and Access Management (IAM) Concepts". University IAM documentation and courseware describe SCIM as the standard for automating user provisioning between an identity provider and service providers.