We added SAML and now provisioning is still a manual headache

That’s a common next pain point after SAML: authentication is solved, but lifecycle management isn’t.

A good way to frame it is:

• SAML = who can log in
• Provisioning = who gets created, updated, disabled, and given access
• Automation = how you stop doing that by hand

What usually causes the manual headache

After SAML, teams often still manually:

• create user accounts
• assign groups/roles
• update attributes like department or title
• disable accounts when people leave
• grant access to apps individually

That means SSO improved sign-in, but joiner/mover/leaver workflows are still manual.

The usual fixes

1) SCIM provisioning

If your apps support it, SCIM is the cleanest answer. It can automatically:

• create users
• update profiles
• deactivate users
• sync group membership

2) Directory-driven access

Use your IdP or directory as the source of truth:

• Entra ID / Okta / Google Workspace
• groups map to app roles
• access changes happen in one place

3) HRIS-triggered workflows

For larger orgs, use HR as the trigger:

• new hire in HR system → account created
• manager change → group update
• termination → access removed everywhere

4) Just-in-time provisioning

If full lifecycle automation isn’t ready, JIT can at least create accounts on first login. It reduces some manual work, though it doesn’t solve deprovisioning well.

If you want to reduce the manual work fast

Start with this order:

1. Identify the top 3 apps causing the most manual provisioning
2. Check whether they support SCIM
3. Map roles to groups instead of assigning users one by one
4. Automate offboarding first — it’s the highest-risk manual process

A simple message you could use internally

We’ve implemented SAML for authentication, but user provisioning is still manual. To eliminate ongoing admin overhead and reduce access risk, we should add SCIM or directory-based provisioning so user creation, updates, and deprovisioning happen automatically.

If you want, I can help you turn this into:

• a short exec summary
• a technical architecture plan
• or a vendor evaluation checklist for SCIM/provisioning.