The Risks of Manual User Provisioning

User provisioning, or user account provisioning, is a vital part of providing workers access to all the applications, documents, and other data they need to do their jobs. IAM managers know that provisioning done poorly creates problems with employee onboarding and offboarding, thus straining relationships between departments and adding unnecessary stress across an organization. Employees are frustrated when they don't have the access they need. Governance, risk, security, and compliance teams are frustrated when employees have too much access or access they don't need or, worse, when poor offboarding doesn't remove access for someone who has left the organization.

More important, though, is the risk that sloppy, inconsistent, and insecure user provisioning can pose for your business and its systems and data.

If you already know what you need to know about manual user provisioning (or you do after reading this article), learn more from our “Complete Guide to User Provisioning with Ping Identity.”

Provisioning is a straightforward concept: It's how you create, update, and delete users and accounts in order to manage the access to your IT infrastructure and the rights, privileges, functionality, information, and data that comes along with that access.

Staying on top of this important process in a growing organization, however, can be challenging. Depending on how large your company’s workforce is, you may have new employees onboarding and departing regularly. You may have people in a number of different departments who need access to different sets of applications, data, and other resources.

It is widely recognized that automated provisioning and deprovisioning is the gold standard. Done well, it is the quickest, most convenient, and most secure approach for your IT department to approach user provisioning. However, companies may be tempted to do provisioning manually. Making this choice grows into a larger problem as a company grows and evolves. 

There are a variety of reasons an IT department may fall back to manual user provisioning. This approach may have made sense when the company was small and the volume of provisioning was low and could be managed and tracked easily. Perhaps the infrastructure–software and hardware–for automated provisioning was once unavailable, or when it became available, other demands on IT staff meant automating provisioning was not prioritized. Maybe IT management has not had the time or budget to requisition what they need, or components have been ordered and delivered but not deployed. Finally, legacy applications and resources used by the organization may not support an automated, API-driven approach for user provisioning.

Whenever humans are tasked with a manual process, they are bound to make mistakes. People forget things, they miscommunicate, they get overwhelmed with multiple projects and priorities, and they may find change and adaptation difficult.

When your company was smaller, there were just a handful of employees. Today, with a much larger workforce, there is just no way you could possibly have time to get to know each one of your workers. The more employees there are coming in, the more there are departing or changing roles, leaving behind accounts that need to be deprovisioned along with a growing wave of new accounts to provision.

Additionally, provisioning demand spikes for a variety of reasons. You may roll out new applications or replace legacy applications with modern equivalents, acquire or merge with another business, or sell part of your company. During rough times, you may have to lay employees off. In good times, team members move up the ladder, move to other departments, and receive new responsibilities.

Despite all efforts to avoid more paperwork and bureaucracy, company growth requires layers of management and approval. Is it okay to give Suzanne access to a particular resource she’s requested? You have to check with Suzanne’s manager–who is that? You find this information and reach out. The manager needs to ask the department head. They are busy, taking a day or two to respond. Once the access request is finally approved, you then schedule and take the time to manually provision Suzanne’s account, giving her the access she needs to do her job.

If Suzanne has a deadline, the clock is ticking, as it always is in business. Can she deliver what’s needed in time? Did the delay in getting her approval cause her to miss deadlines? What has she been doing during this delay?

In short, manual provisioning is slow, expensive, and a drag on productivity. New employees who come into their jobs excited and energized to dig in and get started end up deflated by delays in getting the tools they need. Other employees may obtain or keep access to resources they don’t use or need, which presents both a security risk and a cost, as the company must pay for licenses for them to have access, whether they use it or not. 

Another issue is lack of visibility or auditing around who has access to what. This makes it very difficult for organizations to prove their compliance to obligations set by external auditors.

And we haven’t even touched on the inevitable human error factor.

These types of challenges and unpredictability make it paramount that you move away from or avoid any manual user provisioning.

So, what are your options?

Simply put, you can avoid these costs, delays, security risks due to errors, and other negative factors by automating your user and account provisioning.

Automated provisioning and user onboarding saves time and money, improves productivity, frees people to focus on more important tasks and projects, and creates a documentation trail automatically if questions or audits arise later.

It also makes it easy to automatically add and remove permissions for internal personnel  changes and to close the accounts of people who leave, eliminating security and compliance concerns.

Our integration directory, our ever-expanding application provisioning catalog, includes HR integrations as part of our provisioning capabilities to streamline employee onboarding and offboarding.

We have more than 350 powerful, dynamic IAM integrations, along with other useful tools, that are all part of how Ping improves user provisioning by making it automated, quicker, and simpler while providing your team members safe, secure access to the resources they need.

Access the Ping Integration Directory through our website. Our site is always growing and evolving as part of our constant effort to build user provisioning offerings that help improve the user experience, boost efficiency, cut costs, and improve security.

Our documentation center has details on user provisioning for Ping products, including PingFederate and PingOne.

Reach out through our website to learn more about Ping and our products, get answers to your questions, receive use cases and case studies, discuss your goals, or schedule a demo at your convenience.