Lifecycle management: dormancy, deletion, and the cascade.

Dormant accounts become a liability class. Tens of millions of stale credentials are a credential-stuffing surface and an inflated MAU bill at the same time, so lifecycle stops being hygiene and becomes both a security and a cost problem. Enterprises want policy-driven lifecycle: dormancy detection, re-verification when a dormant user returns, and staged deletion that honors retention rules rather than a hard delete.

Deletion is where the integration surface earns its keep. GDPR and CCPA deletion sounds simple until it has to cascade across the CIAM store, the CDP, the warehouse, and support tooling. A delete that only clears the CIAM record leaves copies everywhere else, which is a compliance failure. The CIAM platform's deletion webhooks and event streams are what make that cascade automatable instead of a manual, error-prone checklist. The same is true for profile-change events feeding downstream systems, which is why evaluators increasingly treat the event and webhook layer as core, not an add-on: identity is upstream of everything, so its events are how the rest of the estate stays correct.

Probe the lifecycle primitives directly: policy-driven dormancy, staged deletion with retention rules, and a deletion-webhook and event layer rich enough to drive the downstream cascade. This pain sits next to integration sprawl, which is the same event layer viewed from the ingestion side.