SCIM automates the deactivation path, not just onboarding.
Cloud Identity manages who exists; IAM manages what they can do.
HR eventNew hire or termination record created
IdPOkta/Azure AD pushes a SCIM create or deactivate call
Cloud IdentityDirectory account provisioned or disabled
IAMAccess follows automatically via group membership
A contractor's account survived 11 days past their end date — tracked in a spreadsheet, not the IdP, so no SCIM deactivation event ever fired. Route every access type through the one system that actually triggers deprovisioning.