title: Lifecycle Management category: Policies tags: lifecycle, remediation, violations, automation, offboarding, onboarding priority: Normal

Lifecycle Management

IdentityCenter's lifecycle management automates the actions that keep your identity environment secure and compliant. When policies detect issues, lifecycle actions automatically respond — disabling stale accounts, notifying managers, creating tickets, and more.

What is Lifecycle Management?

Lifecycle management covers the full journey of an identity in your organization:

How It Works

Lifecycle management is driven by three components working together:

1. Policies — Define the rules (e.g., "accounts inactive for 90 days are a violation")
2. Violation Detection — Policies are evaluated on a schedule and generate violations when rules are broken
3. Remediation Actions — Violations trigger automated responses

Violation Detection

When a policy evaluation finds objects that break the rules, violations are created:

Violation Severity Levels

Viewing Violations

Navigate to Policies > Violations to see all detected issues:

• Filter by severity, policy, status, or date
• Sort by newest, oldest, or highest severity
• Click any violation to see full details and take action

Remediation Actions

When a violation is detected, IdentityCenter can automatically take action. Available remediation actions include:

Automated Actions

Configuring Remediation

When creating or editing a policy:

1. Navigate to Policies > [Your Policy] > Edit
2. Scroll to the Actions section
3. Choose which action to take when a violation is detected
4. Configure action-specific settings (e.g., who receives the alert email)
5. Save the policy

Tip: Start with "Log Only" or "Send Alert" for new policies. Review the violations that get generated before enabling more aggressive actions like account disabling.

Common Lifecycle Scenarios

Stale Account Cleanup

Goal: Find and disable accounts that haven't been used in 90+ days.

1. Create a policy with the condition: "Last logon is more than 90 days ago"
2. Set severity to High
3. Set action to Send Alert to the user's manager
4. After confirming the alerts are accurate, upgrade to Disable Account

Orphaned Account Detection

Goal: Find AD accounts that exist for people who are no longer in the organization.

1. Create a policy with the condition: "Account is active but Person status is Terminated"
2. Set severity to Critical
3. Set action to Disable Account + Send Alert to IT security

Password Policy Enforcement

Goal: Find accounts with "Password Never Expires" that shouldn't have it.

1. Create a policy targeting accounts with the DONT_EXPIRE_PASSWORD flag
2. Exclude service accounts and gMSAs from the policy scope
3. Set action to Flag for Review so it appears in the next access review

Privileged Access Monitoring

Goal: Alert when new members are added to privileged groups.

1. Create a policy targeting members of Domain Admins, Enterprise Admins, Schema Admins
2. Set severity to Critical
3. Set action to Send Alert to the security team immediately

Manager Change Notification

Goal: Trigger an access review when someone changes managers (new manager should review their access).

1. Create a policy detecting changes to the manager attribute
2. Set action to Flag for Review for the new manager to certify existing access

Violation Lifecycle

Each violation moves through a workflow:

Detected → Under Review → Action Taken → Resolved
                ↓
           Accepted (risk acknowledged)

Resolving Violations

Violations are automatically resolved when:

• The account is disabled (for "account active" violations)
• The policy condition is no longer true (e.g., user logged in recently)
• An admin manually marks it as resolved or accepted

Best Practices

1. Start conservative — Use "Log Only" or "Send Alert" before enabling automated actions
2. Review violations weekly — Don't let violations pile up unaddressed
3. Exclude service accounts — gMSAs and service accounts often trigger false positives for login-based policies
4. Use escalation — If a manager doesn't respond to an alert within a week, escalate to their manager
5. Document risk acceptances — When accepting a violation, add a comment explaining why
6. Combine with access reviews — Policies catch ongoing issues; access reviews provide periodic comprehensive checks

Next Steps

• Creating Policies — Define your compliance rules
• Policies Overview — Understand the policy framework
• Access Reviews — Periodic access certification
• Object Write-Back — How account disabling works