← All practicals

Find the drift — directory vs. access

Diff your SCIM directory against real org access, live — and fix a stale grant with one click.

1. 1

   Sign up a SECOND Lab account on another email, invite it into one of your organizations, and accept from that account. Then provision a SCIM user (P20) carrying that same email.

   This is the setup every reconciliation run assumes: a directory record and a live access grant, matched by email — exactly how a real IGA tool correlates an HRIS export against an app’s member list. It genuinely takes two accounts: a pending invite is not access yet, and only a real member can accept one.

2. 2

   Deactivate that SCIM user (flip active off, or delete it) without touching their org membership.

   That’s the classic drift: deprovisioned in the directory, but the app access nobody remembered to revoke is still live — the #1 finding a real access-recertification process exists to catch.

3. 3

   On the Reconciliation lab, run a scan and read the finding.

   The diff is computed live, right now, from your CURRENT scim_users and CURRENT org memberships — nothing is snapshotted or cached, so it can never show you yesterday’s drift as if it were today’s.

4. 4

   Click Remediate on that finding.

   This performs a REAL removal of the membership — re-verified against the live diff first (a finding that already resolved itself refuses with not_a_finding, not a stale delete) — and the finding simply vanishes from the very next scan.