The Contractor Onboarding Gap
A 900-person engineering firm uses an IdP with SSO for most SaaS. A large construction project brings in 60 contractors from 12 different firms. Project managers are emailing IT a spreadsheet of contractor names each Monday, and IT creates local accounts in the project management SaaS and the shared file server. Contractors keep accounts after their engagement ends because nobody tells IT. A recent audit found 23 active contractor accounts with no matching active contract. The IdP supports SCIM provisioning, group-based access, and time-bound entitlements, but the SaaS vendor's SCIM connector is 'beta.' Project managers resist change and say the spreadsheet process 'works.'
1. Diagnose the root cause and identify the control that actually fixes it.
Read the worked answer
The root cause is no authoritative source of truth for contractor identity and lifecycle - access is driven by a spreadsheet and human memory, so deprovisioning depends on someone remembering to notify IT. The fix is not 'better spreadsheets'; it is joiner-mover-leaver automation tied to a system of record. Concretely: contractors should be provisioned from the contract/engagement record (or an HR/vendor management system) with an end date that drives automatic disablement. That is a time-bound entitlement, not a manual cleanup. The control that matters is automated deprovisioning on contract end, backed by periodic access reviews for the exceptions. The spreadsheet is a symptom; the missing lifecycle owner is the disease.
2. The SaaS SCIM connector is beta and PMs resist change. What do you recommend and why?
Read the worked answer
Do not bet the control on a beta connector. Use a defense-in-depth approach:
- Authoritative list: require each contractor to have an engagement record with an end date in the project system (or a maintained roster with a named owner per firm).
- Automated where reliable: use SCIM for the IdP-side groups and for any SaaS that supports it; for the beta connector, pilot with a small cohort and keep a fallback.
- Time-bound access regardless: even without SCIM, issue access with an expiry and require re-attestation to extend. This removes the 'nobody told IT' failure mode.
- Manager accountability: make the PM the access owner with a monthly attestation; non-response means access is suspended. The reason: the goal is no orphaned accounts, and expiry + attestation achieves that even if the ideal automation is delayed. Beta tools are acceptable for a pilot, not for a control you rely on.
3. How would you measure whether the fix is working?
Read the worked answer
Pick metrics that directly test the failure mode:
- Orphaned active accounts: count of active contractor accounts with no active engagement record - target zero, reviewed monthly.
- Time-to-deprovision: median and max days between engagement end and account disablement - target same day.
- Attestation completion rate: percentage of PMs completing monthly access reviews on time.
- Exception count: number of manual/out-of-band accounts and their age. Trend these over quarters. The audit finding (23 orphans) is the baseline; the metric that matters is whether orphans stay at zero, not whether the process 'feels' better.