Provisioning creates or changes access, while deprovisioning disables, reduces or removes it.
Provisioning may create an account, assign a group, add an application role or update identity attributes after an approved request or lifecycle event. Deprovisioning reverses those changes after termination, transfer, expiry, inactivity, policy change or review. Both processes need reconciliation to verify that the target system applied the intended change.