What is true about deprovisioning entitlements?

• A. It removes source accounts
• B. It may require manual intervention
• C. It does not remove source accounts
• D. It auto-expiries all roles

Answer: (C)

Deprovisioning entitlements refers to the process of removing access rights or permissions that have been granted to users within an identity management system. Understanding this concept helps in managing user access effectively and ensuring security.

The statement that deprovisioning entitlements does not remove source accounts is accurate. During the deprovisioning process, the focus is primarily on revoking permissions and access associated with the user’s identity rather than deleting the user’s entire account or source identity. This allows for a more controlled access management approach, where the user account remains intact but without the associated entitlements that give them access to certain resources or roles.

By maintaining the source account, organizations can keep an audit trail and preserve the user's history for compliance or future re-provisioning if needed. This approach is beneficial for organizations that may need to reinstate access or for compliance reasons, where historical user data may be required.

The other choices involve aspects that aren't accurate representations of the deprovisioning process. While deprovisioning may sometimes require manual intervention, it is not a universal truth and often can be automated through identity governance processes. Removing source accounts is not part of the typical deprovisioning process and most systems do not auto-expire all roles when ent