Identity Lifecycle Calculator

orphan identities live at any moment = leavers per day × average deprovisioning delay, and each drags its application accounts with it. Deprovisioning delay converts a leaver rate into a standing population of orphan accounts, in the same way arrival rate times service time gives queue length. The score penalises that population, the dormant tail and the delay itself, because a long delay is a risk even in a month with few leavers.

Orphan and dormant accounts are the credentials nobody will notice being used — no owner to report a phish, no manager to spot the login, and frequently no MFA either.

This calculator takes 6 inputs: Employees, Contractors and third parties, Leavers per month, Average delay from exit to disable, Application accounts per identity, Accounts unused past the dormancy threshold. The pre-filled defaults are a realistic starting point — replace them with figures from your own environment for a result you can act on.

Same-day disable for employees and within the hour for involuntary terminations, driven by HR being the authoritative source rather than by a ticket. Contractors need an explicit end date on the account at creation, since nobody files a leaver ticket for a contract that simply lapses.

An orphan has no valid owner at all; a dormant account has an owner who has stopped using it. Both are unmonitored attack surface, but dormancy is also a signal for right-sizing — an account unused for 90 days usually indicates access that was never needed.