
## The problem nobody notices until it's too late. {#the-problem-nobody-notices-until-its-too-late}

Every organisation keeps accounts it no longer needs. Contractors leave, interns graduate, support vendors rotate out - but their creds often remain active across apps, websites, and services. These ‘digital zombies’ sit dormant, forgotten, and dangerous: easy targets for attackers, insider misuse, or accidental data exposure. Left unchecked, they become a silent vector for data leaks, compliance failures, and costly audits.

Our Drupal User Provisioning module eliminates digital zombies by keeping accounts in sync with your central identity system. When someone joins, their access is granted everywhere they need it and when they leave, it’s automatically revoked across all connected sites.

## What are digital zombies? {#what-are-digital-zombies}

Digital zombies are user accounts that are still active even though the person or process that needed them are gone or no longer exist/authorised. They look like normal accounts in your user list, but functionally they're an empty seat that still has a lot of privileges. 

They can bypass and/or slip past account audits because they appear normal in the long user list.

## What creates a Zombie Account? {#what-creates-a-zombie-account}
**Manual Processes:**
- If the IT or Human Resources department is manually creating accounts for all new hires across systems, they also have to manually disable the accounts when the person inevitably moves on.

**Forgotten Accounts:**
- Third party vendors and contractors are given temporary access, but their access is never revoked.
- Accounts created for testing or integration purposes and are orphaned and never deleted.

**Dormant Access:** 
- A person's roles get changed but their access rights still stay active, and these rights are never audited to      revoke unnecessary access.
  
## What happens when these accounts are left unchecked? {#what-happens-when-these-accounts-are-left-unchecked}

Forgotten accounts are not just something that takes up space in your database. They are dormant parasites that can create real risk:

**Unauthorized Access & Data Theft:**
- Attackers look for low - effort entry points; an abandoned, unattended, inconspicuous account with high privileges is an easy target.
- Once in, attackers can move through the system and exfiltrate data as and when required.

**Compliance Violations:**
- Regulations like GDPR, SOC2, HIPAA require timely access auditing - These forgotten zombie accounts can trigger penalties or block you from passing a compliance check at all.

**Overpaying for Licences:**
- If you’re using a tool which has a user-based billing, then you might end up overpaying for licence seats that are being blocked/consumed by dormant accounts, costing you hundreds if not thousands of dollars a month.

The solution? Something that can automate the process of user account creation and deletion i.e. Automatic User Provisioning and De-provisioning. 
Perhaps, something like the [**Drupal User Provisioning & Sync Module.**](https://www.drupal.org/project/user_provisioning)

Our User Provisioning module is a complete solution that automates the entire user lifecycle - from onboarding to offboarding. When a new employee joins, their account and roles are automatically created in Drupal by syncing with the central identity provider (through SCIM or APIs).

The module also has provisions using which you can decide when this Syncing occurs. You can either set it to happen as and when someone requests access to the system - Provisioning on demand.
Or you can have it occur in real time - immediately after any changes (CRUD Operations) take place.
Or to eliminate repeated processes, you can have it run at a specific time - based on a scheduler.

## The Benefit? {#the-benefit}

**Data consistency across all services.**

Any updates, changes to the role, group or any attribute of the user, are reflected across all connected sites.

**Automatic Creation and Deletion of Accounts.**

When the employee leaves, their account is automatically deprovisioned / disabled or removed from everywhere - closing the risk window of forgetting ‘zombie’ accounts. 
This also reduces overhead on the IT and HR departments.


**Auditing**

The module maintains a full audit trail of every action - success and failure - and provides admin notifications. 


**Final Thoughts**

Having the Drupal User Provisioning and Sync module run defence for you ensures all the users are accounted for, their access rights audited, and eliminates human error all the while giving the organisations something to maintain security and achieve compliance without manual effort.
 
That means - No more forgotten doors left open for attackers; No more data breaches; And No more compliance red flags; 

Take proactive steps today and make zombie accounts a thing of the past.

And if you want an even higher level of security - you can start by adding [SSO](https://plugins.miniorange.com/drupal-saml-single-sign-on-sso) and [MFA](https://plugins.miniorange.com/drupal-two-factor-authentication-2fa) to secure the way the users log in.

Stop leaving the doors open for attackers. Protect your Drupal site with automated provisioning that creates, updates, and removes user accounts in sync with your identity system.

SCIM Client

Protect your Drupal Sites with Automated Provisioning