--- Title: "User provisioning automation: nine IT access request tools from approval to revocation" Url: "https://devrev.ai/blog/best-it-access-request-provisioning-software" Published: "2026-10-22" Last Updated: "2026-10-22" Author: "DevRev Editorial" Excerpt: "Most access request tools handle the grant. We compare nine on whether temporary access is removed on time and where that removal happens." Reading Time: 16 --- # User provisioning automation: nine IT access request tools from approval to revocation **TL;DR** - User provisioning automation runs on three layers: a service automation layer takes the request, a governance tool decides and reviews it, and an identity provider writes the access. - Removal is where the tools split. As of October 2026, six of the nine tools here document automatic removal at expiry, and Zluri joins them once you link a playbook. Neither our help center nor Moveworks’ pages document it. - A removal can stop short of the app. Okta, Microsoft Entra ID, and JumpCloud take people out of a group or assignment, and the app changes only if its connector carries that change. - Our pick for the service automation layer is Computer, by DevRev. It routes each request to the manager or IT admin who has to act, writes records in your ServiceNow service desk, and tells the requester where things stand. Pair it with a tool that holds the expiry timer. Every demo of user provisioning automation goes the same way. Someone asks for access, a manager taps “approve,” and the account appears before the salesperson finishes the sentence. Nobody demos what happens a week later, when the contractor’s project ends and their admin role is meant to end with it. That’s the half that turns up in audit findings, usually months after anyone remembers why the access was there. We put the same three questions to the documentation for nine tools that vendors sell as one category: did the access land in the app, did anything check, and did it leave on time? The nine sit on three layers, and in our reading, most buying mistakes come from asking one layer to do another’s job. ## IT access request tools at a glance This is desk research: every claim here comes from the vendors’ own documentation and pricing pages, ours included, read on September 30, 2026, and checked again on October 16, 2026. We didn’t run the tools. The practitioner quotes, from Reddit and the software review site G2, speak for one person each and carry a link and date; an entry has none where we found no conversation about that tool. | Tool | Best for | Layer | Where people ask | How it provisions | Pricing model | | --- | --- | --- | --- | --- | --- | | Computer | Okta or Entra ID and ServiceNow teams chasing approvals | Service automation | Slack and our own apps; agents for employees listed as “coming soon” | Routes to a manager or IT admin; writes ServiceNow records | $30 Pro on our Computer site; “Contact us” on devrev.ai; credits | | Moveworks | ServiceNow shops wanting requests in Slack or Teams | Service automation | Slack, Teams, and four more chat surfaces | Adds the employee to an Okta, Entra ID, or Active Directory group | Not published | | Lumos | A self-serve catalog with pre-approval rules | Access requests and governance | AppStore, Slack, Teams, CLI | Identity-provider group, connector, webhook, or manual task | Not published | | C1.ai | Security-led teams wanting entitlement-level requests | Access requests and governance | Web, Slack, Teams (not on the EU instance), CLI | Connector to the app, linked identity-provider entitlement, or ticket | By managed identities or usage; not published | | Opal | Short-lived cloud, database, and SaaS admin access | Access requests and governance | Web catalog, Slack, CLI | Native integration to the entitlement, or ticket | Not published | | Zluri | SaaS-heavy companies requesting license tiers | Access requests and governance | Web catalog, Slack | Playbook of API actions, or manual task | Not published | | Okta | Companies already on Okta | Identity provider | End-User Dashboard; Slack and Teams for request types | Okta assignment, then each app’s provisioning | From $17 per user a month, billed annually | | Microsoft Entra ID | Microsoft-first companies; contractor access | Identity provider | My Access portal | Group or app role, then each app’s connector | $10 per user a month (P2), paid yearly | | JumpCloud | Small and mid-size teams already on JumpCloud | Identity provider | User Portal | JumpCloud user group | $5 per user a month add-on, billed annually | ## The nine IT access request tools, by layer ### 1. Computer, by DevRev – the service layer that asks, routes, and checks ![Screenshot for 1. Computer, by DevRev – the service layer that asks, routes, and checks](https://cdn.sanity.io/images/umrbtih2/production/30a5cc7977ad3fce366050e9fdaf3fd18dd8e9e5-624x351.png) Computer is our AI teammate for the service automation layer of IT access requests, and it sits above your identity provider. An employee asks in Slack or in Computer itself. Our [service desk automation page](https://devrev.ai/use-cases/service-desk-automation) describes Computer checking “their identity and the company’s policy” before it makes a change. Which changes Computer makes itself depends on the connectors and actions you set up. Until you build one for an app, the request goes to a manager or IT admin. Adnan Bhutta, our Corporate Vice President of Business Growth, described that hand-off when we announced our [partnership with OpenAI](https://devrev.ai/blog/openai-announcement), the company behind ChatGPT, in September 2026: “If access needs a manager’s approval or an IT administrator’s action, the request goes to that person with the relevant details. The employee can check its status, while the existing IT system remains the system of record.” **Best for** – IT teams that already run Okta or Microsoft Entra ID and ServiceNow, and lose their days in the gaps between them: the asking, the approval chase, and “did it go through?” **Provisioning and write-back** – Write-back is the step that writes an approved change into the system that holds the access. Data sync is native. Our AirSync connectors read Okta and Microsoft Entra ID on a schedule you choose, with daily syncs recommended for Okta, so you can [confirm in Computer](https://devrev.ai/marketplace/devrevlabs-okta) that someone’s Okta groups changed. Among our identity, human resources, and ServiceNow connectors, the documented write-back for access work goes to [ServiceNow records](https://support.devrev.ai/en-US/devrev/article/GujEKqBQ-servicenow-airsync). Action execution is something you configure: a workflow can call any web service through the [HTTP node](https://support.devrev.ai/en-US/devrev/article/0Nf3WUcZ-http-node) and pause until a set time. An agent skill asks for confirmation before it runs only when its “[Needs Approval](https://support.devrev.ai/en-US/devrev/article/kIjLyjeT-agent-studio-reference)” setting is switched on, and it’s off by default. Ticket approvals can run in Slack or email. **Pricing** – We sell on consumption credits, and Agent Studio sits in Pro. Pro is listed at $30 a month on [our Computer site](https://computer.io/pricing), with a discount for annual billing. On our devrev.ai [pricing page](https://devrev.ai/pricing), Pro and Max both read “Contact us,” so ask us which plan your build needs. **Limitations** - Our help center doesn’t document a duration on the request or automatic revocation, so you’d build them from workflow timers and an HTTP or Model Context Protocol (MCP) action. Our [guide to AI access control](https://devrev.ai/blog/ai-access-control) describes the pattern, with “automatic revocation when the window closes.” - Our identity connectors don’t write: the Okta connector is “[no write-back](https://support.devrev.ai/en-US/devrev/article/mKHCupBE-okta-airsync-connector)” and the Entra ID connector is “[read-only](https://support.devrev.ai/en-US/devrev/article/Pf4L4nuQ-azure-entra-id-airsync-connector).” - As of October 2026, our [Agent Studio help article](https://support.devrev.ai/en-US/devrev/article/LhjCUxm2-agent-studio) lists the internal agent type, for agents you build for employees, as “coming soon.” Ask us where that stands for your workspace. [This DevRev video](https://www.youtube.com/watch?v=7aGh9mJUjz0), from our own channel, has our Co-Founder and CEO, Dheeraj Pandey, explaining why routine employee requests shouldn’t wait on another person, and where people and agents still need to work together. In a demo, we’ll walk a request from Slack to its approver, then show you where Computer confirms the Okta group change after the sync runs. [Book a demo →](https://devrev.ai/demo) ### 2. Moveworks – ServiceNow’s AI assistant, with a configurable approval engine ![Screenshot for 2. Moveworks – ServiceNow’s AI assistant, with a configurable approval engine](https://cdn.sanity.io/images/umrbtih2/production/3631a3e32ebdb61d415a0ae007e6c05e84a5cb56-624x324.png) [Moveworks](https://www.moveworks.com/) is now part of ServiceNow, the enterprise workflow software company, which [completed the acquisition on December 15, 2025](https://cxtoday.com/servicenow-moveworks-acquisition). Moveworks’ strength is the approval step: its native approvals engine routes to a manager, an app admin, or a group owner, and it ships a workflow that auto-approves employees and sends contractors to a person. **Best for** – ServiceNow shops that want requests and approvals in Slack or Teams, with roles mapped to identity-provider groups. **Provisioning and write-back** – Moveworks adds the employee to a group in Okta, Entra ID, or Active Directory, and the identity provider’s System for Cross-domain Identity Management (SCIM) integration then creates the app account. Moveworks’ documentation says it supports up to 100 roles per app. **Pricing** – Moveworks doesn’t publish prices and quotes each deal. **Limitations** - Moveworks says it “does not support Contractor Expiry out of the box” and points to Agent Studio for it. We didn’t find an expiry setting on its built-in access skills as of October 2026, so ask. - Moveworks documents removal from an email group only for Google Workspace and Active Directory. - Moveworks keeps built-in plugin logs for one week. On G2, where Moveworks is listed as ServiceNow EmployeeWorks, an engineer at a large enterprise finds it “especially helpful for common IT requests such as password resets, access requests, or simply checking ticket status.” For less common issues, though, “I still end up needing to escalate to a human agent.” _Himanshu M., Software Engineer._ [G2, April 2026 ↗](https://www.g2.com/products/servicenow-employeeworks/reviews/servicenow-employeeworks-review-12688111) ### 3. Lumos – an app store for access, with a timer ![Screenshot for 3. Lumos – an app store for access, with a timer](https://cdn.sanity.io/images/umrbtih2/production/1cb0811f58d69ca9d1b8362d8cd8241d41865aa6-624x499.png) Employees ask in the [Lumos](https://www.lumos.com/) AppStore, Slack, Teams, or a command line. Timed access is a setting: “After expiry, Lumos will automatically remove user’s access.” **Best for** – Teams that want a self-serve catalog with pre-approval rules. **Provisioning and write-back** – An approval can add the requester to an identity-provider group or call a connector at the entitlement level. It can fire a webhook for things the identity provider can’t reach, such as license types, and it can also create a manual task. **Pricing** – Not published. Lumos prices through an assessment form. **Limitations** - On the request form, requesters pick a duration from a list set per app, from two hours to 90 days or unlimited, rather than an exact end time. - The public pages don’t say how expiry works on each fulfillment path, so ask to see your app’s. On _r/IdentityManagement_, a customer who runs Lumos alongside Okta answered a team shopping for an identity governance vendor: “We use the Lumos AppStore for access requests and approval. Works really well.” _u/phunklounge._ [r/IdentityManagement, September 2026 ↗](https://www.reddit.com/r/IdentityManagement/comments/1wast6s/looking_for_iga_vendor_for_3000_employees_and_600/p9cmfbx/) ### 4. C1.ai, formerly ConductorOne – a map of where every removal lands ![Screenshot for 4. C1.ai, formerly ConductorOne – a map of where every removal lands](https://cdn.sanity.io/images/umrbtih2/production/5c2c027e5d8cfb468bf19412595f609189b7897d-624x363.png) ConductorOne renamed itself [C1.ai](https://www.c1.ai/) in April 2026. In October 2026, Workday, the human resources and finance software company, [agreed to acquire C1.ai](https://www.prnewswire.com/news-releases/workday-to-acquire-c1ai-a-leading-agentic-identity-platform-for-people-and-agents-302906593.html), with closing expected by January 31, 2027. C1’s documentation spells out what happens after approval: “C1 revokes the grant when the window closes,” and reminders go out from 30 days to one hour before. **Best for** – Security-led teams that want entitlement-level requests and an audit export in an open format. **Provisioning and write-back** – The provisioning guide names each path and its reverse: a connector deprovisions in the app, C1 removes a linked entitlement in the identity provider, and external ticketing opens a helpdesk ticket. **Pricing** – Not published. C1.ai prices by managed identities or by usage, and says “Exact pricing scoped with you.” **Limitations** - “All connectors can read (sync) data, and some can also write (provision) to the connected software.” Where one can’t, the revoke becomes a manual deprovisioning task for the app owner. - Microsoft Teams isn’t yet supported on the EU data residency instance. ### 5. Opal – requests for the role inside the app ![Screenshot for 5. Opal – requests for the role inside the app](https://cdn.sanity.io/images/umrbtih2/production/ce59f814529a5d6604d0a17b038c8a0203b1be62-624x426.png) [Opal](https://www.opal.dev/)’s catalog goes below the app: its docs describe requesting “an admin role to a SaaS application,” and its integration pages list grant and revoke per object, such as Salesforce permission sets, profiles, and roles. At expiry, “Opal will automatically revoke your access.” Requests longer than a day get reminders first. **Best for** – Engineering-heavy companies granting short-lived access to cloud accounts, databases, and software-as-a-service (SaaS) admin roles. **Provisioning and write-back** – Opal writes through its native integrations, and elsewhere it’s a custom connector, or a one-way webhook where “you are responsible for any access drift.” Opal can also open a Jira ticket for a person. **Pricing** – Not published. Opal’s pricing link leads to a demo form. **Limitations** - Opal creates the account in the app only for the integrations it lists, 17 as of October 2026, among them Salesforce, Snowflake, HubSpot, and custom connectors. - Opal guarantees log display and export for 90 days unless you stream them. ### 6. Zluri – app-level actions, and candor about the manual ones ![Screenshot for 6. Zluri – app-level actions, and candor about the manual ones](https://cdn.sanity.io/images/umrbtih2/production/20d41539717b51e12f2d6061f7cad557162998e5-624x444.png) [Zluri](https://www.zluri.com/)’s request form carries license type, app role, and duration, and approval runs a provisioning playbook. Then, its documentation says, “Zluri will run the selected deprovisioning actions automatically once the access period ends” or conditions match. Its run log keeps the app’s response to each action. **Best for** – SaaS-heavy companies where the request is for a license tier. **Provisioning and write-back** – Playbooks call API actions in the app. With no integration, Zluri falls back to a custom HTTP action, a Jira ticket, or a manual task a person marks complete. **Pricing** – Not published. Zluri’s pricing link leads to a demo form. **Limitations** - Expiry is opt-in twice: the duration is optional on the form, and the deprovisioning playbook is optional on the rule. An admin can close the first with a fixed duration. - Segregation of duties is “currently available to a limited set of customers.” - The audit-log API returns seven days per call. On G2, an employee at a large company describes the request path from the requester’s side: “These approvals are routed through the manager and the application lead before a license is assigned.” _Caleb G., KYC Associate._ [G2, October 2025 ↗](https://www.g2.com/products/zluri/reviews/zluri-review-11831660) ### 7. Okta – the identity provider that enforces the timer ![Screenshot for 7. Okta – the identity provider that enforces the timer](https://cdn.sanity.io/images/umrbtih2/production/ff2ea5b902ba44ff7f1f998a4a56ad10d28b1967-624x437.png) Access Requests is part of [Okta](https://www.okta.com/) Identity Governance. An admin sets a duration on the request condition, or lets the requester pick one up to a maximum. Then, “When the access request expires, the user’s access is automatically revoked.” The requester gets a warning one day and one hour before. Okta also reaches below the app where its connector allows: conditions can offer entitlement bundles, and the connector list covers Salesforce permission sets, profiles, and roles. Separation-of-duties rules block a conflicting request by default. Afterward, a report shows the date each revocation was due and the date access ended, and Okta keeps that data for three years. **Best for** – Companies already on Okta that want the request, the expiry, and the certification on the platform that makes the assignment. **Provisioning and write-back** – Approval changes the Okta assignment, and what reaches the app depends on that app’s provisioning integration. Okta’s note: “Not every feature in the following list is available for every app integration.” On removal, Okta deactivates the app account where the integration supports it, and otherwise it tells admins to deprovision by hand. **Pricing** – The Essentials suite, the lowest printed plan with Access Governance, is $17 per user a month, billed annually, with a $1,500 annual contract minimum. The governance add-on price isn’t published. **Limitations** - Okta has two request engines: conditions carry the expiry and can’t run Okta actions or the Jira and ServiceNow integrations. Request types can, and their date timer ends at midnight. - Enabling Governance Engine on an app “removes the access expiration” for anyone granted through a condition. - The separation-of-duties check reads existing assignments, so two open requests can slip past it. On _r/okta_, an Okta Certified Administrator explains how to make a resource outside single sign-on (SSO) requestable. Their fix: tie a bookmark app to a group, then “allow users to select a maximum duration for access, and then it pulls them from that group.” _u/iNteg._ [r/okta, January 2026 ↗](https://www.reddit.com/r/okta/comments/1qi4mp3/has_anyone_built_a_custom_self_service_for_okta/o0oygiv/) ### 8. Microsoft Entra ID – access packages with expiry built in ![Screenshot for 8. Microsoft Entra ID – access packages with expiry built in](https://cdn.sanity.io/images/umrbtih2/production/6cc57b5f267bfde0e3cfe1924f7ae7bbe5a63912-624x418.png) [Microsoft Entra ID](https://www.microsoft.com/en-us/security/business/identity-access/microsoft-entra-id)’s entitlement management bundles groups, app roles, and SharePoint sites into access packages, which people request in the My Access portal. A policy can expire assignments on a date, after a number of days, or after a number of hours, and it can carry up to three approval stages. **Best for** – Microsoft-first companies, and contractor access in particular. Entra creates a guest account on approval, then blocks and later removes it once its last assignment ends. **Provisioning and write-back** – The assignment is a group membership or an app role in Entra ID, and the app changes only through its provisioning connector, which disables the account by default. With no connector, Microsoft’s own tutorial creates ServiceNow tickets “for manual provisioning.” **Pricing** – Entra ID P2 is $10 per user a month, paid yearly. Microsoft’s licensing page shows P2 covers access packages and their expiry, while custom extensions need ID Governance, sold as a step-up for P2. **Limitations** - Microsoft steers just-in-time elevated access to Privileged Identity Management. - Approval is an email link into My Access. - Entra keeps audit events for 30 days unless you export them to Azure Monitor. On _r/entra_, an admin running 2,500 or more access packages calls them great, then warns about bulk work in the graphical user interface (GUI): “The GUI is clunky and absolutely doesn’t scale well.” _u/Corridors._ [r/entra, August 2026 ↗](https://www.reddit.com/r/entra/comments/1vzg18t/access_packages/p6nrw8i/) ### 9. JumpCloud – timed group access inside the directory you already run ![Screenshot for 9. JumpCloud – timed group access inside the directory you already run](https://cdn.sanity.io/images/umrbtih2/production/d9fcde5a73f4fb66d3192a69c6574212bbe2540f-624x393.png) [JumpCloud](https://jumpcloud.com/)’s Access Requests keeps the model simple: approval adds the requester to a user group, and JumpCloud’s blog says timed access removes them “the instant the timer expires.” Approvals can run in Slack. **Best for** – Small and mid-size teams on JumpCloud that need timed, everyday access without a governance product. **Provisioning and write-back** – The write is a group membership, and JumpCloud’s own note is that “the final fulfillment of access may require additional configuration.” **Pricing** – Access Requests is a $5 per user a month add-on, billed annually, and of JumpCloud’s six packages, only Platform Prime includes it. **Limitations** - JumpCloud positions it for “day-to-day, non-privileged access needs” and points privileged access to its separate product. - JumpCloud keeps Directory Insights logs for 90 days. ## The Friday 5 PM test for user provisioning automation **The scenario:** a contractor gets an admin role on a production tool for one week, ending Friday at 5 PM. Amar Gautam, Head of DevRev Labs, asks the same thing about a contractor’s two-week grant on our blog, in “[The Invisible Half of Employee Self-Service](https://devrev.ai/blog/employee-self-service-beyond-the-ticket)”: “Two weeks later, what takes the access away? At most companies, nothing does.” Few documented request forms take a clock time. You get a duration, an end date in Microsoft Entra ID, or a date timer that ends at midnight in Okta’s request types. Okta’s request types now also offer a “Date and Time” question, but its page doesn’t say whether the timer reads it. One rule covers every cell, our own row included: each cell says only what that vendor’s pages say. “Not documented” describes those pages, not the product. | Tool | Expiry on the request | At expiry | Where the removal lands | How you verify | Audit trail | | --- | --- | --- | --- | --- | --- | | Computer | Not in our help center | Not in our help center; a build with workflow timers | Not in our help center; actions are yours to build | Lookup of identity data, synced on a schedule | API-call logs by admin export; workflow runs | | Moveworks | Not documented | Not documented; a build in Agent Studio | Not documented for software | Plugin log of the call | Plugin logs, one week; approval audit on request | | Lumos | Duration from a list | Automatic | Depends on method | Request status; full sync | Activity log by API | | C1.ai | Preset or custom duration | Automatic | Depends on method | Grants list after a sync | Task audit log; OCSF export | | Opal | “Expires in” duration | Automatic | The entitlement in the app, or a ticket | Propagation events; periodic sync | CSV, API, and stream; 90 days | | Zluri | Optional duration | Automatic if a playbook is linked | The app by API action, or a manual task | Run log with the app’s response | Request changelog; audit log | | Okta | Duration on the condition | Automatic; may take a few minutes | Okta assignment; the app by its connector | Revocation status in reports | Reports kept three years | | Microsoft Entra ID | Date, days, or hours | Automatic | Entra group or app role; the app by its connector | Expired filter; provisioning logs | Audit events; 30 days | | JumpCloud | Duration on the flow | Automatic | JumpCloud user group | Active Sessions view | Named event types; 90 days | Our count asks whether the vendor’s pages say the tool removes access automatically at expiry. Six say “yes” (Lumos, C1.ai, Opal, Okta, Microsoft Entra ID, and JumpCloud), and Zluri says “yes” once you link a playbook. Our help center and Moveworks’ pages are the two that don’t. - **What the pages don’t show:** “Automatically revoked” tells you the tool acted. Zluri, Opal, and Microsoft Entra ID also record the write or the app’s response. In the pages we read on October 16, 2026, none of the nine documents an immediate check of the app after an expiry removal. - **Security will ask:** Get two screens in every demo: the removal reaching the app, and what happens when that call fails. Pick the production tool where a forgotten admin role would hurt most, and run the Friday test on it before you buy. Grant yourself a role for an hour, then check the app, not the tool. The result tells you which layer to buy first. Bring your riskiest app to a demo, and we’ll show which steps Computer runs and which stay with your identity provider. [Book a demo →](https://devrev.ai/demo) ## FAQ ### What is user provisioning automation? User provisioning automation is software that grants, changes, and removes people’s access to apps as they join, move, and leave, without someone clicking through each admin console. An IT access request tool is its front end: it takes the request, checks policy, routes the approval, and records the outcome, while the identity provider usually writes the grant itself. ### What is the difference between IAM and IGA? Identity and access management (IAM) authenticates people and authorizes their access, while identity governance and administration (IGA) governs that access over time, covering requests, approvals, access reviews, and separation of duties. Okta and Microsoft sell governance in a higher plan or as an add-on to the identity provider. C1.ai, Opal, Lumos, and Zluri sell it on their own. ### Does SCIM handle access revocation? Partly. SCIM can deactivate or delete an account and change group membership, and RFC 7643 leaves the meaning of both to each app. It defines no expiry date and no vocabulary for roles. Removing one admin role depends on the app’s connector. RFC 7643: https://www.rfc-editor.org/rfc/rfc7643. ### Who should approve access requests? Whoever owns the risk. For everyday apps, that’s usually the requester’s manager, and for sensitive roles, it’s the app or resource owner. Most tools here document routing to a manager or an owner. Look for a fallback approver and delegation for absences. ### What should be included in an access request? Include six things. Say who needs access and which app, then add the role or license inside it and the business reason. Name the approver, and set an end date. A request for “access to Salesforce” with no role and no end date is how a one-week admin grant becomes permanent.