
## The problem nobody notices until it's too late. {#the-problem-nobody-notices-until-its-too-late}

Every organisation keeps accounts it no longer needs. Contractors leave, interns graduate, support vendors rotate out - but their creds often remain active across apps, websites, and services. These ‘digital zombies’ sit dormant, forgotten, and dangerous: easy targets for attackers, insider misuse, or accidental data exposure. Left unchecked, they become a silent vector for data leaks, compliance failures, and costly audits.

Our Drupal User Provisioning module eliminates digital zombies by keeping accounts in sync with your central identity system. When someone joins, their access is granted everywhere they need it and when they leave, it’s automatically revoked across all connected sites.

## What are digital zombies? {#what-are-digital-zombies}

Digital zombies are user accounts that are still active even though the person or process that needed them are gone or no longer exist/authorised. They look like normal accounts in your user list, but functionally they're an empty seat that still has a lot of privileges. 

They can bypass and/or slip past account audits because they appear normal in the long user list.

## What creates a Zombie Account? {#what-creates-a-zombie-account}
**Manual Processes:**
- If the IT or Human Resources department is manually creating accounts for all new hires across systems, they also have to manually disable the accounts when the person inevitably moves on.

**Forgotten Accounts:**
- Third party vendors and contractors are given temporary access, but their access is never revoked.
- Accounts created for testing or integration purposes and are orphaned and never deleted.

**Dormant Access:** 
- A person's roles get changed but their access rights still stay active, and these rights are never audited to      revoke unnecessary access.
  
## What happens when these accounts are left unchecked? {#what-happens-when-these-accounts-are-left-unchecked}

Forgotten accounts are not just something that takes up space in your database. They are dormant parasites that can create real risk:

**Unauthorized Access & Data Theft:**
- Attackers look for low - effort entry points; an abandoned, unattended, inconspicuous account with high privileges is an easy target.
- Once in, attackers can move through the system and exfiltrate data as and when required.

**Compliance Violations:**
- Regulations like GDPR, SOC2, HIPAA require timely access auditing - These forgotten zombie accounts can trigger penalties or block you from passing a compliance check at all.

**Overpaying for Licences:**
- If you’re using a tool which has a user-based billing, then you might end up overpaying for licence seats that are being blocked/consumed by dormant accounts, costing you hundreds if not thousands of dollars a month.

The solution? Something that can automate the process of user account creation and deletion i.e. Automatic User Provisioning and De-provisioning. 
Perhaps, something like the [**Drupal User Provisioning & Sync Module.**](https://www.drupal.org/project/user_provisioning)

Our User Provisioning module is a complete solution that automates the entire user lifecycle - from onboarding to offboarding. When a new employee joins, their account and roles are automatically created in Drupal by syncing with the central identity provider (through SCIM or APIs).

The module also has provisions using which you can decide when this Syncing occurs. You can either set it to happen as and when someone requests access to the system - Provisioning on demand.
Or you can have it occur in real time - immediately after any changes (CRUD Operations) take place.
Or to eliminate repeated processes, you can have it run at a specific time - based on a scheduler.

## The Benefit? {#the-benefit}

**Data consistency across all services.**

Any updates, changes to the role, group or any attribute of the user, are reflected across all connected sites.

**Automatic Creation and Deletion of Accounts.**

When the employee leaves, their account is automatically deprovisioned / disabled or removed from everywhere - closing the risk window of forgetting ‘zombie’ accounts. 
This also reduces overhead on the IT and HR departments.


**Auditing**

The module maintains a full audit trail of every action - success and failure - and provides admin notifications. 


**Final Thoughts**

Having the Drupal User Provisioning and Sync module run defence for you ensures all the users are accounted for, their access rights audited, and eliminates human error all the while giving the organisations something to maintain security and achieve compliance without manual effort.
 
That means - No more forgotten doors left open for attackers; No more data breaches; And No more compliance red flags; 

Take proactive steps today and make zombie accounts a thing of the past.

And if you want an even higher level of security - you can start by adding [SSO](https://plugins.miniorange.com/drupal-saml-single-sign-on-sso) and [MFA](https://plugins.miniorange.com/drupal-two-factor-authentication-2fa) to secure the way the users log in.

Stop leaving the doors open for attackers. Protect your Drupal site with automated provisioning that creates, updates, and removes user accounts in sync with your identity system.

Protect your Drupal Sites with Automated Provisioning

### What is Just in Time (JIT) Provisioning? {#what-is-just-in-time-jit-provisioning}
**JIT provisioning** automates the creation and updation of user accounts in web applications. It delivers information from an identity provider to web apps via the SAML (Security Assertion Markup Language) protocol.

IT administrators no longer have to manually create accounts for each user in every application thanks to JIT provisioning. Rather, user accounts are created when users attempt to log in to applications for the first time, as long as they have the authorization to do so. 

Just in Time (JIT) Provisioning is used to create users the first time they log in to an application via a third-party identity provider. JIT provisioning eliminates the need to provision users or create user accounts manually. This saves effort and time. JIT Provisioning is independent of the SSO protocol used by the application but it’s vital to note that for this approach to work, the web application must support Just in Time (JIT) Provisioning. 

### How does Just in Time (JIT) provisioning work? {#how-does-just-in-time-jit-provisioning-work}
To enable JIT provisioning, administrators must first set up [Single Sign-On (SSO)](https://www.miniorange.com/products/single-sign-on-sso) between the target service provider i.e., web application and the identity provider and confirm that the user attributes required by the application are included. As a result, when new users attempt to log in to the application for the very first time, they will instantly invoke the creation of their account, rather than requiring an admin to do it. SAML assertions provide the web application with the information it requires from the identity provider.

Admins can use a centralized cloud identity provider or an SSO service built on top of their traditional directory to achieve this workflow. They must ensure that the selected service provider supports JIT provisioning during setup. Slack and Atlassian suite are some popular examples of applications that offer JIT provisioning.

For example, if your organization hires many new employees, you’ll want to set up user accounts for them as quickly and smoothly as possible. For this, you can first set up SSO and JIT provisioning in all the applications. Once it is configured, when new employees use SSO to log in to an application, the JIT provisioning approach creates their accounts automatically.

Also, when user attributes are updated in the identity provider, these attributes are automatically updated in all the various applications that the user has used.

The most efficient way to deploy Just in Time Provisioning is to use an identity provider like miniOrange since admins can then configure application privileges by role or group and remove application access from a single location.

![JIT Provisioning](/blog/assets/2023/jit-workflow.webp) 

### How is SAML SSO related to Just in Time (JIT) Provisioning? {#how-is-saml-sso-related-to-just-in-time-jit-provisioning}
**SAML SSO** can be [identity provider (IDP) initiated or service provider (SP) initiated](https://www.miniorange.com/blog/idp-initiated-sp-initiated-login/). In the IDP initiated SSO, users first login to their SSO portal where they can access all the applications in which they have configured SSO. In SP initiated SSO, the user first visits the application and is redirected to their SSO portal where they are logged in automatically by their identity provider.

[SAML protocol](https://www.miniorange.com/iam/solutions/saml-single-sign-on-sso) is safe because instead of transmitting user credentials, it sends XML-based certificates which are distinct to each application. As a result, the service provider never obtains their credentials or keeps track of them.

There isn’t much difference between SAML SSO and JIT provisioning. Users that use SAML SSO only have to provide their credentials once per session to access all of the applications they need to get their work done. Using Just in Time (JIT) Provisioning on top of SSO helps to automate the whole process of user account creation. This makes IT operations like the onboarding process much more efficient and smooth.’

### What are the benefits of Just in Time (JIT) provisioning? {#what-are-the-benefits-of-just-in-time-jit-provisioning}
**SAML SSO** can be identity provider (IDP) initiated or service provider (SP) initiated. In the IDP initiated SSO, users  
- JIT provisioning automates the process of creating accounts for users on various applications. Thus, it saves time and reduces the workload of admins.
- It reduces the IT administrative costs as instead of doing routine tasks, the IT admins can dedicate their time for more important tasks. Also, JIT provisioning prevents the need to synchronize the Identity Provider (IDP) and Service Provider (SP) user stores manually.
- With the use of JIT provisioning, the whole account creation process becomes streamlined. The users won’t need to create additional accounts for every application they want to use, thus, it reduces unnecessary account creation.
- JIT provisioning also increases the security of an organization as the users use only one identity to access all the applications. It also applies password policies for all the accounts created automatically. This helps to prevent Identity Sprawl.

### Conclusion {#conclusion}
Just in Time (JIT) Provisioning is a SAML protocol based method that is used to create users the first time they log in to an application via an identity provider. This eliminates the need to provision users or create user accounts manually. Although JIT Provisioning is independent of the SSO protocol used by the application, it is necessary that the application supports JIT Provisioning. Just in Time (JIT) Provisioning automates the whole process of user account creation. It reduces the administrative costs, increases efficiency, productivity and security of an organization.

If you are looking to implement Just in Time (JIT) Provisioning, contact miniOrange to know more about the solution and its pricing.





Just in Time Provisioning (JIT) automates the creation of user accounts in web applications. It delivers user information from the identity provider to web apps via the SAML protocol.

User Lifecycle Management

Protect your Drupal Sites with Automated Provisioning

What is Just in Time (JIT) Provisioning | How does JIT work?