What is the difference between onboarding, user management, and offboarding in the JML model?

Onboarding creates and equips a new identity for work, user management keeps that identity current as roles and permissions change, and offboarding removes access when employment ends. Together, these Joiner, Mover, and Leaver stages define the full identity lifecycle. Each stage needs different controls, but all three must stay synchronized to prevent unnecessary access.

Why JML Matters for Access Control Hygiene

Joiner, Mover, and Leaver controls are easy to describe and hard to keep aligned. Onboarding is not just account creation, user management is not just “keeping profiles updated,” and offboarding is not just disabling a login. If those stages drift apart, organisations accumulate stale access, orphaned credentials, and privileges that no longer match job function. That mismatch is especially dangerous where human and non-human identities coexist, because the same lifecycle weakness can affect people, service accounts, and automation at once.

For identity teams, the core risk is not the terminology itself but the handoff gaps between HR, IT, security, and application owners. The Ultimate Guide to NHIs — Lifecycle Processes for Managing NHIs is useful here because lifecycle control is one of the clearest places where policy breaks down in practice. NIST’s Cybersecurity Framework 2.0 also reinforces that identity governance is an ongoing operational discipline, not a one-time provisioning task.

NHIMG research shows why this matters: 91% of former employee tokens remain active after offboarding, which turns a routine HR event into a persistent access-risk problem. In practice, many security teams encounter JML failures only after a role change or termination has already left access behind, rather than through intentional lifecycle review.

How the Three JML Stages Work in Practice

Onboarding, user management, and offboarding are distinct control moments, but they should operate as one continuous workflow. Onboarding establishes the identity, assigns the first set of permissions, and ensures the person or workload can do the job on day one. User management then keeps access current as the role evolves, which usually means adjusting group membership, reviewing entitlements, revalidating approvals, and removing temporary access that has outlived its purpose. Offboarding ends the relationship by revoking accounts, tokens, device trust, application access, and any delegated privileges.

A practical JML process usually includes:

• Joiner controls: identity proofing, account creation, baseline access, and initial policy assignment.

• Mover controls: role-change triggers, entitlement recertification, and timely privilege updates.

• Leaver controls: disablement, credential revocation, token invalidation, and evidence of completion.

The most reliable programmes connect HR events, IAM workflows, and application provisioning so that a single status change can trigger the right action across all systems. The NHI Lifecycle Management Guide is relevant because the same lifecycle logic applies to service accounts and API keys, not just employees. For baseline governance, NIST’s Cybersecurity Framework 2.0 remains a useful reference for tying identity processes to protect, detect, and respond outcomes.

Where many organisations go wrong is treating “user management” as a static admin queue instead of a control loop with ownership, auditability, and expiration dates. These controls tend to break down when HR, IAM, and application owners operate on different clocks because access changes then lag behind the real-world job change.

Where JML Breaks Down and What Teams Should Watch For

Tighter JML controls often increase operational overhead, requiring organisations to balance speed of access with the cost of review, approval, and cleanup. That tradeoff is real, especially in fast-moving environments where teams change frequently and projects need immediate access.

Best practice is evolving toward more automation, but there is no universal standard for this yet. Some organisations use just-in-time provisioning for sensitive access, while others rely on periodic access reviews and manual deprovisioning workflows. The right model depends on risk, system criticality, and how well identity events are integrated across the enterprise.

Common edge cases include contractors, shared service accounts, break-glass access, and third-party integrations. Those cases often do not fit neatly into a human HR-driven lifecycle, which is why identity owners need explicit exceptions, expiry controls, and documented ownership. The Top 10 NHI Issues is relevant because many of the same failure patterns show up when access is created without a clear offboarding path.

NHIMG’s research also highlights the scale of the problem: 80% of identity breaches involved compromised non-human identities such as service accounts and API keys. For practitioners, the lesson is straightforward: if joiner, mover, and leaver processes are not synchronized, access drift becomes a normal state rather than an exception.

Related resources from NHI Mgmt Group

• What is the difference between user_metadata and app_metadata in identity management workflows?
• What is the difference between a vertically integrated Microsoft stack and an open directory platform for identity management?
• What is the difference between model serving and model deployment?
• What is the difference between a co-existence migration and a full cutover from web access management to modern identity?