User Provisioning Calculator

lifecycle events = joiners + leavers + movers; account operations = events × applications per user. Every lifecycle event fans out across every connected application, so the operation count is headcount churn multiplied by application count. Automation coverage is the only term that scales, because manual minutes per operation barely improve with practice.

The manual remainder is where deprovisioning delay lives, and delay is what turns a resignation into an orphan account with live credentials.

This calculator takes 6 inputs: Headcount in scope, Annual turnover, Staff changing role each year, Applications provisioned per user, Minutes per manual account operation, Operations handled by automation. The pre-filled defaults are a realistic starting point — replace them with figures from your own environment for a result you can act on.

SCIM gives the identity provider a standard REST API for creating, updating, deactivating and deleting accounts in a target application, plus group membership sync. Where an application supports it, joiner and leaver operations become near-instant; where it does not, you are back to a ticket, a script or a CSV.

A joiner only needs grants, but a mover needs grants for the new role and revokes for the old one — and the revoke half is the part that gets skipped. Accumulated mover residue is the most common source of separation-of-duties violations found in access reviews.