Access provisioning and deprovisioning is automated through HR system integration
Connecting HR or the staff directory to the identity provider so lifecycle events fire automatically closes the manual relay gap that stale or orphaned accounts, A.5.16's core risk, come from.
Connecting HR to the identity provider so leaver events disable accounts automatically removes the manual relay step where A.5.18 revocations most often slip.