Which statement best describes provisioning in an IAM lifecycle?

• A. It creates user accounts and assigns initial access based on role or request.
• B. It removes access and deletes accounts when users leave.
• C. It enforces password complexity and rotation policies.
• D. It monitors user activity for compliance.

Answer: (A)

Provisioning is the process of creating user identities and granting the initial access rights needed to perform their role. It happens during onboarding, where a new user account is created in the directory and permissions or group memberships are assigned based on the role or a specific access request. This is why the statement describing creating accounts and assigning initial access best fits provisioning: it directly covers both identity creation and entitlement assignment at the start of the user lifecycle. Deprovisioning—removing access and deleting accounts when a user leaves—is the opposite part of the lifecycle. Enforcing password complexity and rotation is about credential policy management, not provisioning. Monitoring user activity relates to auditing/compliance rather than provisioning.