# SP-044 SaaS Identity Lifecycle Management

Status: active. Release 2.0. Modified 2026-02-13. Licence: CC BY-SA 4.0.

Scope: A security architecture pattern for managing the full identity lifecycle across SaaS applications -- from provisioning and role assignment through access reviews and deprovisioning. Addresses privilege creep, contractor access governance, orphaned accounts, and cross-application identity synchronisation in organisations with significant SaaS estates.
Use when: Organisation has more than 20 SaaS applications. Audit findings related to orphaned or excessive access.
Not when: Small organisations with fewer than 10 SaaS applications may find manual lifecycle management sufficient.

## Controls (32, NIST SP 800-53 ids)
- Critical (11): AC-02, AC-03, AC-06, AU-02, CA-02, IA-02, IA-04, IA-08, PS-04, PS-05, PS-07
- Important (11): AC-05, AC-16, AC-24, AU-03, AU-06, AU-12, CA-07, CM-08, IA-05, IA-12, SA-09
- Standard (10): AC-01, AC-17, AC-21, AT-02, AT-03, CM-03, IA-09, PL-04, PM-10, PM-14

## What each critical control mitigates (11)
- AC-02 Account Management: T-SIL-001, T-SIL-003, T-SIL-006, T-SIL-009, T-SIL-012
- AC-03 Access Enforcement: T-SIL-005, T-SIL-011
- AC-06 Least Privilege: T-SIL-002, T-SIL-005, T-SIL-008
- AU-02 Event Logging: T-SIL-010, T-SIL-012
- CA-02 Control Assessments: T-SIL-002, T-SIL-008, T-SIL-010
- IA-02 Identification and Authentication (Organizational Users): T-SIL-011
- IA-04 Identifier Management: T-SIL-001, T-SIL-007
- IA-08 Identification and Authentication (Non-organizational Users): T-SIL-003
- PS-04 Personnel Termination: T-SIL-001, T-SIL-006
- PS-05 Personnel Transfer: T-SIL-002
- PS-07 External Personnel Security: T-SIL-003

## Threats and the controls that mitigate them (12)
- T-SIL-001 Orphaned accounts persisting after employee departure enabling unauthorised access: PS-04, AC-02, IA-04
- T-SIL-002 Privilege creep from role changes accumulating unnecessary entitlements over time: PS-05, CA-02, AC-06
- T-SIL-003 Contractor access persisting beyond engagement end date: PS-07, AC-02, IA-08
- T-SIL-004 Shadow SaaS adoption creating ungoverned identity stores outside central control: CM-08, SA-09, PL-04
- T-SIL-005 Over-provisioned accounts from template-based onboarding granting excessive access: AC-06, AC-03, AC-05
- T-SIL-006 Delayed deprovisioning creating exploitable window between termination and access revocation: PS-04, AC-02, CA-07
- T-SIL-007 Identity attribute desynchronisation across SaaS applications causing access policy drift: IA-04, AC-16, CM-03
- T-SIL-008 Insider threat exploiting accumulated unnecessary access from multiple role changes: CA-02, AU-06, AC-06
- T-SIL-009 Account takeover of dormant but active SaaS accounts with weak or unchanged credentials: IA-05, CA-07, AC-02
- T-SIL-010 Compliance violation from unrecertified access in regulated environments: CA-02, AU-02, PM-14
- T-SIL-011 Cross-tenant data exposure from misconfigured identity federation in multi-tenant SaaS: SA-09, AC-03, IA-02
- T-SIL-012 Approval workflow bypass via emergency provisioning without subsequent review: PM-10, AU-02, AC-02

## More
- The critical controls and what each mitigates, as JSON (a few KB): /api/v1/patterns/SP-044/crosswalk?emphasis=critical
- The same for every control, with its clauses in a framework: /api/v1/patterns/SP-044/crosswalk?framework={framework id}. Framework ids are listed in /llms.txt
- The pattern's prose, examples and references as JSON, 25 KB: /api/v1/patterns/SP-044
- Page for people: /patterns/sp-044/
- Found an error? Open an issue at https://github.com/opensecurityarchitecture/osa-data/issues with the id, what OSA says and what the source says.
- Related: SP-010 Identity Management Pattern; SP-029 Zero Trust Architecture; SP-032 Modern Authentication; SP-033 Passkey Authentication; SP-037 Privileged User Management; SP-042 Third Party Risk Management

This card, the API and the page are generated from one file. Checking one against another adds no evidence.