Between the decision to grant access and the existence of a working account sits a queue. In most enterprises that queue is a ticketing system, and the work inside it - creating accounts, setting attributes, assigning groups, and eventually disabling all of it - is performed by hand, application by application. The delay is measured in days for joiners. For leavers, the more dangerous direction, the work is frequently never completed at all.
The enterprise challenge: accounts as manual artefacts
Every application that maintains its own user store needs accounts created, updated and removed as the workforce changes. Handled manually, this produces predictable failure modes: inconsistency, because two administrators provision the same role differently; latency, because tickets wait; drift, because updates that should follow HR changes never propagate; and orphaned accounts, because disablement is the step with no constituency pushing for it. Each orphaned account on a critical system is a credential waiting to be abused, invisible until an audit or an incident finds it.
Why scripts and CSV loads are not a solution
Many IT teams automate fragments of this with scripts and scheduled exports. These help until they do not: scripts encode one moment's understanding of one application's API, break silently when the application changes, and rarely handle the update and disable paths as well as the create path. Most importantly, scripted point-to-point automation has no concept of the whole - no single place that knows what accounts should exist everywhere, and no mechanism to detect when reality has drifted from that intent.
The Tanflow approach: provisioning as a platform function
The Tanflow IAM Suite makes account provisioning a function of the identity platform. Accounts are created, updated and disabled automatically across connected systems, driven by the identity's lifecycle state and role assignments rather than by tickets. SCIM - the standard protocol for cross-domain identity provisioning - carries these operations to applications that support it, while Tanflow's integration layer also provides Active Directory connectors and REST APIs for the systems that do not.
The intent lives in one place. The Tanflow Identity Directory is the authoritative source for every identity and attribute; RBAC and dynamic policies translate those attributes into entitlements; provisioning executes the result outward. When the underlying facts change - a transfer, a name change, an exit - the downstream accounts change with them, without a human re-entering data into each system.
Reconciliation closes the loop. Because connected systems can always be modified locally, Tanflow's provisioning includes reconciliation across connected systems to catch drift between what should exist and what does - the locally created account nobody sanctioned, the leaver account a script failed to disable.
The provisioning workflow in practice
- An identity event occurs - a joiner from HR, a role change, an approved access request.
- Tanflow calculates the target state: which accounts, attributes and group memberships this identity should now have in each connected system.
- SCIM operations and connector actions push the changes out; results are confirmed and logged.
- Reconciliation periodically compares connected systems against the target state and surfaces discrepancies for correction.
Every operation is attributable - which event caused it, which policy justified it - and lands in the audit trail.
Enterprise scenario
Consider an IT services organisation onboarding a project team of twenty engineers for a new client engagement. Under manual provisioning, that is twenty joiners multiplied by half a dozen systems - a week of tickets. Under platform provisioning, the engagement role carries the entitlements; assigning the role provisions everything; and, critically, the engagement's end date will one day reverse all of it with the same automation. The client's security questionnaire item - "describe how access is removed when staff roll off" - now has a one-sentence, evidenced answer.
Governance and audit implications
Automated provisioning is what makes deprovisioning trustworthy, and deprovisioning is where auditors look first. With Tanflow, the leaver evidence chain is continuous: the HR event, the calculated revocations, the executed operations and the reconciliation confirming nothing was missed - all searchable and exportable through Audit and Reporting. Orphaned-account findings stop being an annual embarrassment because the mechanism that produced them is gone.
Conclusion
Accounts should be a consequence of identity, not a craft product of ticket queues. Tanflow's provisioning and SCIM capability makes them exactly that - created in minutes when a role requires them, corrected when facts change, disabled the moment the reason expires, and reconciled against drift in between. The queue disappears, and with it the orphaned accounts it used to leave behind.