We have a quite elaborate set up for Active Directory, and would like to use this to provision & deprovision access to the Control Panel. Would this be possible in Craft core or in a plugin? Are there hooks to use alternative access methods?
No, this is not available in the core. There is a plugin which deals with OAuth which may help you.
You can view a list of hooks which Craft provides out of the box here.
I imagine you will need to develop your own plugin for this. There is some guidance in the Craft documentation on creating hooks/events in a custom plugin if that's the route you'd prefer go down.