Julian, the lead Identity Architect, has finished the initial integration of a new AI platform. He has successfully completed the "Configure SSO"…

The "zombie account" issue is a classic deprovisioning failure. While SSO handles authentication (logging in), it does not manage the user account lifecycle (creation, updates, deletion) in the downstream application. SCIM (System for Cross-domain Identity Management) is the open standard protocol designed specifically to automate this process. Enabling SCIM sync between the corporate directory (IdP) and the AI platform (SP) ensures that when a user is deleted from the directory, their corresponding account in the AI tool is also automatically deprovisioned.

A. Test access controls: This validates user permissions after they are provisioned, but does not address the provisioning or deprovisioning of the account itself.
B. Define role hierarchy: This organizes user permissions and access levels, which is unrelated to the automated creation or deletion of user accounts.
D. Map to IdP groups: This assigns roles and permissions based on directory group membership but does not handle the deprovisioning of the user's profile.

1. Internet Engineering Task Force (IETF). (2015). RFC 7643: System for Cross-domain Identity Management: Core Schema. (Section 1 introduces SCIM's purpose: "to automate the user provisioning and deprovisioning process").

2. Internet Engineering Task Force (IETF). (2015). RFC 7644: System for Cross-domain Identity Management: Protocol. (Section 3.3 describes how DELETE operations are used to deprovision resources, directly addressing the scenario).

3. Microsoft. (2023). Provisioning with SCIM - getting started. Microsoft Entra ID Documentation. (The document explicitly states, "The SCIM specification provides a common user schema for provisioning... Use it to automatically provision and deprovision users and groups to applications").