User lifecycle
Managing the user lifecycle covers the complete trajectory of an individual’s access within your organization: provisioning when joining, adjusting roles during internal transfers, and deprovisioning upon offboarding. Proper lifecycle management is a vital security discipline, as unmonitored or orphaned accounts that persist after an employee leaves represent one of the most significant access risks in enterprise SaaS environments.
Provisioning and onboarding
Section titled “Provisioning and onboarding”Provisioning is the process of creating a user account and assigning initial workspace access:
-
Targeted role assignment — accounts are created via direct invitation or bulk upload with specific roles pre-assigned. See Users and invitations.
-
Least-privilege baseline — users receive only the permissions required for their specific job functions on day one, eliminating excessive access windows. See the Capability matrix.
-
Day-one productivity — new team members land in a workspace pre-configured with the exact tools, connectors, and guardrails necessary for their specific position.
Deprovisioning and account deactivation
Section titled “Deprovisioning and account deactivation”Prompt, thorough offboarding is just as critical as onboarding:
- Clean access revocation — when an employee leaves or changes responsibilities, administrators deactivate or adjust their account to terminate platform access instantly.
- Audit trail preservation — deactivating a user revokes login privileges and active API tokens while permanently preserving historical interaction logs, execution records, and workflow transcripts for compliance audits.
- Risk mitigation — deactivation prevents former employees or contractors from retaining access to corporate data, connectors, or agents.
Automated lifecycle management via SCIM
Section titled “Automated lifecycle management via SCIM”At enterprise scale, manual onboarding and offboarding introduce operational bottlenecks and human error. Rival Enterprise supports SCIM 2.0 (System for Cross-domain Identity Management) to automate user provisioning and deprovisioning through your identity provider:
- Joiner-mover-leaver automation — accounts are created, updated, or deactivated automatically based on changes in your identity provider.
- Real-time access sync — adding an employee to an identity provider group provisions their Rival account; deactivating them revokes Rival access instantly, with no manual administrative intervention required.
A quick example: automated lifecycle sync
Section titled “A quick example: automated lifecycle sync”Consider an enterprise using SCIM to manage platform access:
- Role transition — an employee moves from Customer Support to Sales. The change in the corporate directory updates their group membership, automatically adjusting their Rival workspace team and permissions.
- Contractor offboarding — a contractor’s engagement ends, and IT deactivates their account in the central identity provider.
- Instant revocation — the contractor’s Rival access, active sessions, and personal API tokens terminate immediately without an IT administrator ever needing to sign in to Rival manually.
User lifecycle architecture summary
Section titled “User lifecycle architecture summary”| Lifecycle stage | Manual workflow | Automated SCIM workflow |
|---|---|---|
| Joiner (onboarding) | Admin manually issues email invite and assigns role | Identity provider auto-creates the account and assigns the team on directory sync |
| Mover (role update) | Admin manually reassigns teams, roles, and connectors | Directory updates automatically trigger real-time role adjustments |
| Leaver (offboarding) | Admin manually suspends account inside the Rival console | Provider deactivation instantly revokes access, sessions, and tokens |
Next steps
Section titled “Next steps”- Connect your identity provider for single sign-on → SSO setup
- Manage user roles and permission boundaries → Roles overview
- Structure users into operational departments → Teams and departments