SCIM Lifecycle Lab
Most breaches do not start with a zero-day — they start with access that outlived the person. Work a reconciliation queue between HR and the directory and give each account its lifecycle action: provision a joiner least-privilege, re-scope a mover (grant the new role and remove the old — not just add), fully deprovision a leaver down to live tokens and owned data, and catch the gaps reviews exist to find — an orphaned account, over-retained access and segregation-of-duties conflicts, an overdue deprovision, a contractor past its end date, a service account that needs governing not off-boarding. You are scored on correct actions against false positives — because deprovisioning a valid or on-leave user is its own failure. Reconcile the queue clean.
The real job. More noise, a tighter clock.
Lifecycle reconciliation
Reconcile each account against HR as of the snapshot 2026-10-14: reconciled, or the specific lifecycle action.
#1
Priya Anand
Associate Analyst
signal: New hire starts today. HR record created; no directory account or access provisioned yet.
#2
Marcus Reed
Sales Engineer
signal: Last working day is today; HR has flagged termination. Account still fully active.
#3
Sofia Herrera
moved: IT Support → Security Operations
signal: Transfer to Security Operations effective this week. Access is still the old IT Support set.
#4
Jordan Mills
Marketing Coordinator
signal: Steady-state employee. Access matches the current role; no pending HR event.
#5
Ben Okafor
Operations Lead
signal: Terminated 60 days ago per HR, yet the account is still active — and shows a login 3 days ago.
#6
Dana Fischer
Contract Developer (Vendor: Northwind)
signal: Contract end date was 30 days ago. Contractor is not in the employee HR feed, so no leaver fired.
#7
Lena Vogt
moved 9mo ago: Payroll → Recruiting
signal: Transferred to Recruiting 9 months ago and settled, but still holds Payroll-Admin from the old role.
#8
batch-run-07
(no HR record)
signal: Active account that maps to no identity in the HR source of truth and has no owner or manager.
#9
svc-dw-etl
Data-warehouse ETL service account
signal: Non-human service account. Credentials are shared in a team runbook; no assigned human owner.
#10
Omar Haddad
Senior Accountant
signal: On approved parental leave; expected to return. No login for ~7 weeks.
#11
Grace Lim
moved: Support → Product (re-scoped)
signal: Transferred to Product last quarter. The move was processed and old Support access was removed.
#12
Tariq Boone
Finance Manager (fixed-term ending)
signal: Last day is in 2 days. Owns an approver role and the shared AP mailbox that others depend on.
#13
Isabel Cortez
promoted: AP Clerk → AP Supervisor
signal: Promoted within AP. Kept invoice-entry from the clerk role and gained invoice-approval as supervisor.
#14
Noah Pike
Rehire — Support Engineer
signal: Rehire: a former employee returning. Their old account still exists but is disabled, with no access.
Correct actions vs. false positives
Reconcile each account, then grade. So far 0/14 called, 0/11 lifecycle actions right, 0 false positive(s).
How it is scored
Correct-action rate = accounts given the exact right lifecycle call (reconciled rows included).
A false positive (actioning a healthy or on-leave account) takes an extra hygiene bite — deprovisioning a valid user is its own incident.
Harder tiers add subtler rows and deliberate traps: an on-leave account, a mover already re-scoped, a fully-deprovisioned leaver, a contractor with a valid sponsor.
Live arena
4 activeadversary staging…
What this lab is
- A free, browser-based identity-lifecycle lab: work a reconciliation queue of ~20 accounts between the HR system of record and the IdP, and give each one the correct SCIM-style Joiner / Mover / Leaver action.
- Actions you assign: provision least-privilege on a joiner, re-scope a mover (grant the new role AND remove the old — the common failure is adding access without removing it = privilege accumulation), and fully deprovision a leaver (disable, revoke sessions/tokens, reclaim licences, reassign data ownership).
- Governance findings seeded across the queue: orphaned accounts with no owner, over-retained access and segregation-of-duties conflicts, missing/overdue deprovisioning, live tokens on a disabled account, contractor end-date gaps, and shared/service accounts that human JML does not cover.
- You are graded on correct-action rate weighed against false positives — deprovisioning an on-leave employee or re-flagging a clean leaver takes an extra hygiene penalty, because breaking a valid user is its own incident.
- All date reasoning is made against a fixed snapshot, and after grading every account shows why the right action is right — genuine IGA / SCIM lifecycle practice.
Frequently asked questions
What is the SCIM Lifecycle Lab?
A free, in-browser exercise where you work a reconciliation queue of identity-lifecycle snapshots — each row shows an account's HR status, directory state, owner, start/end dates, last login, assigned entitlements, token status and MFA — and you assign the correct action: reconciled (no change), or a Joiner/Mover/Leaver action, or a governance finding such as an orphaned account, over-retained access, an overdue deprovision, a contractor end-date gap, or a service account that needs governing rather than human lifecycle. It models what a SCIM provisioning connector and an IGA access review put in front of you.
How is it graded?
Each account has one correct action. Your score is the share of accounts you call with the exact right action, reconciled rows included. False positives — actioning a healthy account, such as deprovisioning someone on approved leave or re-flagging a leaver that was already fully deprovisioned — carry an extra hygiene penalty, because an identity team that breaks valid users is as harmful as one that misses standing access. A perfect run calls every account exactly right.
What lifecycle concepts does it teach?
The Joiner/Mover/Leaver model and where it breaks. Joiner: provision only the least-privilege birthright set. Mover: re-scope by adding the new role AND removing the old in the same change (bidirectional — a mover can also lose access); the classic failure is adding without removing, which accumulates privilege and creates segregation-of-duties conflicts. Leaver: a full deprovision is more than disabling the login — it includes revoking sessions, OAuth tokens and API keys, reclaiming licences, and reassigning data ownership. Plus the gaps lifecycle reviews exist to find: orphaned accounts, over-retention, missing deprovisioning, non-employee end-date gaps, and non-human/shared accounts outside JML.
Does it connect to my directory or HR system?
No. Nothing is uploaded and no SCIM, directory or HR API is called. The accounts are authored, realistic reconciliation snapshots bundled with the page, and every date decision is made against a single fixed snapshot date so the queue is deterministic and never goes stale. It runs entirely in your browser — no account, no install, nothing sent anywhere.
Who is it for?
IAM and identity-governance engineers, IT and security teams who run provisioning and access reviews, auditors checking JML controls and segregation of duties, and anyone prepping for a security or identity interview who wants to feel why an orphaned account, a terminated user with a live API token, or an auditor who can still approve payments is a finding — and why an on-leave employee who keeps their access is not.