In an SSO environment, provisioning of user accounts to downstream applications is typically:

• A. Centralized through the identity provider to ensure consistent lifecycle management.
• B. Performed independently by each application with no central control.
• C. Not required once SSO is enabled.
• D. Only needed for password reset events.

Answer: (A)

Centralized provisioning through the identity provider ensures consistent lifecycle management across all applications. In an SSO setup, the IdP is the authoritative source of user data, and provisioning automates creating, updating, and deprovisioning accounts in each downstream app based on changes in the IdP. This keeps user attributes, group memberships, and account status in sync, and enables rapid offboarding so access is removed from every app when a user leaves or changes roles.

If provisioning were done separately by each app, accounts and privileges could drift apart, leading to inconsistent access and more administrative effort to keep everything aligned. SSO handles authentication, but it doesn’t by itself guarantee the coordinated management of user accounts across multiple apps. Provisioning is not only about password resets; it governs the entire lifecycle of user access across the ecosystem.