An identity and access management administrator must execute the standard offboarding workflow upon an employee's immediate departure. Arrange the operational deprovisioning steps in the correct chronological order from first to last.
- 1Receive and verify the official human resources termination notification.
- 2Revoke active single sign-on (SSO) sessions and invalidate OAuth access tokens.
- 3Disable the user's primary account within central directory services.
- 4Remove resource group memberships and transfer file asset ownership to a manager.
- 5Archive account operational logs and preserve metadata according to compliance policy.
Answer
The correct deprovisioning sequence begins with verifying the HR notification, immediately revoking active SSO sessions and tokens, disabling the user account in directory services, stripping entitlements and reassigning data ownership, and finally archiving logs for compliance retention.
The correct sequence aligns with IAM operational best practices for offboarding: verifying authorization (HR notice), immediately revoking active sessions/tokens to stop ongoing access, disabling directory accounts to prevent new logins, revoking group entitlements and reassigning asset ownership, and finally archiving audit records for compliance.
Step-by-Step Solution
Key Concept
Account Lifecycle Management and Offboarding Operations