Leavers are de-provisioned within 24 hours

When Darwinbox records a termination, the Entra ID account is disabled and downstream application access removed within 24 hours of the last working day.

Requirements

ISO-A.5.18 A.5.18 · Access rights

ISO-A.6.5 A.6.5 · Responsibilities after termination or change of employment

ITGC-AM-01 ITGC-AM-01 · Access provisioning and de-provisioning is authorized and timely

RBI-ITGRCA-2023-7.1 RBI-ITGRCA-2023 §7.1 · Access control — least privilege, privileged access management, periodic review (RBI Master Direction on IT Governance, Risk, Controls and Assurance Practices, 2023)

SOC2-CC6.2 CC6.2 · User registration and authorization prior to issuing credentials

SOC2-CC6.3 CC6.3 · Role-based access, least privilege and segregation of duties; access modification and removal

Policy

pol-access · Access Control Policy

Applications

Darwinbox HRMSMicrosoft Entra IDSAP S/4HANA

Third parties

—

Testing procedure

Darwinbox -> Entra lifecycle workflow; SCIM to downstream apps; SAP lock job. Tests: Darwinbox HRMS: Terminations feed reconciled to IdP; Microsoft Entra ID: No sign-ins after termination; SAP S/4HANA: Terminated users locked in SAP. Frequency continuous.