Identity and Access Management (IAM) Lifecycle in NetSuite

Identity and Access Management (IAM) Lifecycle: How User Provisioning and Deprovisioning Functions in NetSuite

In NetSuite, user provisioning and deprovisioning is managed through the Employee Record, which serves as the central control point for creating accounts, assigning roles or global permissions, and managing access throughout the user’s lifecycle. When a new user is onboarded, their account is created and roles are assigned directly within the Employee Record, while the Manage Roles page is used to customize role definitions / design. Administrators can also grant Global Permissions directly via the Employee Record—a capability that requires careful oversight, as it can bypass role-based controls and introduce privilege creep if not closely monitored.

Identity and Access Management (IAM) Lifecycle: Compliance Considerations

From a compliance perspective, both SOX and ISO 27001 A.9.2 place clear requirements on managing this process. SOX calls for timely provisioning and deprovisioning for systems impacting financial reporting, while ISO 27001 A.9.2 mandates formal user access management, including proper registration, privilege assignment, and prompt removal of access upon termination or role change. Together, these frameworks underscore the need for disciplined access governance in NetSuite, with the Employee Record at the center of the control environment.

Identity and Access Management (IAM) Lifecycle Overview

• Provisioning:
  • User accounts are provisioned via the Employee Record.

Employee Record:

• Access Administration:
  • Roles are granted via the Employee Record and administered through the Manage Roles page.
  • Users can also be assigned Global Permissions directly through the Employee Record, overriding role-based assignments.

Access Assignment Tab of the Employee Record:

• Deprovisioning
  • Inactivate Employee Record: Prevents login but retains employee record information.
  • Delete Employee Record: Removes the user entirely from the system (not typically recommended as it delete employe record information)

Inactivate Employee Record Option:

Delete Employee Record Option:

When it’s time to deprovision a user, administrators have two main options: inactivating the Employee Record or deleting it. Inactivation is the preferred approach—it blocks login while preserving historical data for audit purposes. Deletion, while possible, can remove important historical references and make the rehire process more cumbersome, so it’s generally avoided except in specific cleanup scenarios.

Identity and Access Management (IAM) Lifecycle: Risks

The risks of poor provisioning and deprovisioning practices are clear: dormant or orphaned accounts can linger unnoticed, ready to be exploited to give malicious attackers unauthorized access. This is especially concerning when Global Permissions grant elevated access outside normal role governance.

To reduce these risks, organization should implement strong user life cycle controls.

Identity and Access Management (IAM) Lifecycle: Controls

• HR Termination Triggers: If NetSuite is not your core HR system, integrate your HR system with NetSuite so that when an employee termination or status change is recorded in the HR system, the corresponding NetSuite Employee Record is automatically inactivated. This ensures account access is revoked immediately, reducing the window of opportunity for unauthorized activity after separation.
• Ticket Approval Workflow: Require all user provisioning, role assignments, and role modifications to go through a documented ticketing system. Each request should include business justification, appropriate approvals (e.g., manager, security administrator), and a clear record of the access granted or removed. This provides an auditable trail for both security and compliance purposes. For role modifications, ensure that all changes are tested in a test environment by appropriate business or IT management before being deployed in production.
• Auto-Disable After Inactivity: Unfortunately, NetSuite does not have a built-in, native “auto-disable after X days of inactivity” setting. Because of this, organizations can either implement a custom script to automatically inactivate accounts that have not been used for a defined period (e.g., 90 days) or manually review user accounts that haven’t logged in for a defined period via the Login Audit Trail. The Login Audit Trail can be exported to Excel, allowing management to analyze login activity over time. By using Excel’s filtering or pivot table functions, it’s possible to identify accounts that have not logged in within the organization’s defined inactivity threshold. Either a custom script or manually review process helps eliminate dormant accounts that may be forgotten but still vulnerable to exploitation.
• Quarterly Access Reviews / Recertifications: Require managers to review and certify user access at least quarterly, with a particular focus on high-risk roles, permissions, and users with Global Permissions. Reviews should confirm that all access remains appropriate based on the user’s current job responsibilities. Any unneeded roles or permissions should be removed immediately.
• Restrict Employee Record Maintenance – Limit create, edit, or full access to Employee Records exclusively to IT administrators or customized IT provisioning roles. These roles should be tightly controlled and granted only to approved personnel. Restricting access prevents unauthorized or accidental creation, modification, or deletion of user accounts, which could otherwise bypass provisioning controls and create significant security and compliance risks.

By treating the Employee Record not just as an administrative necessity but as a key control point in your ERP security, you can ensure that NetSuite accounts remain accurate, compliant, and well-governed throughout the user lifecycle.