Onboarding and offboarding best practices for identity lifecycle management are to provision access from approved role data, apply least privilege, and remove or disable access immediately when employment or contracts end. Teams should automate joiner-mover-leaver workflows, review privileged entitlements, and confirm that accounts, tokens and device access are revoked consistently.
What should happen at joiner and leaver stages?
Onboarding works best when access starts from an approved source of truth, such as HR or contractor records, and is mapped to a defined role or entitlement set rather than assembled ad hoc. Offboarding should be treated as a time-bound control event, not an administrative cleanup task: the account, related tokens, sessions, and connected device access should be removed or disabled as part of the exit process.
That approach reduces the chance of birthright access turning into long-lived privilege creep. It also makes mover cases easier to handle because the same lifecycle logic can remove outdated access before new access is granted, instead of letting old and new permissions accumulate together.
How does provisioning stay accurate as people change roles?
Best practice is to make joiner-mover-leaver workflows deterministic. The identity record should drive provisioning, approved roles should define the baseline, and exceptions should be visible and owned. When a person changes department, manager, contractor status, or project assignment, the old access should be removed as deliberately as the new access is added.
That is where access reviews and entitlement recertification matter. They catch drift that automation alone will not prevent, especially where application owners have created local exceptions, shared accounts, or direct grants that bypass the normal role model. IAM and IGA Basics is a useful reference point for understanding how provisioning, access reviews, and entitlement governance fit together.
For organisations that manage contractors, vendors, and non-employee identities, the lifecycle has to include expiry dates, sponsorship, and periodic confirmation that the relationship is still valid. A joiner process that works for employees often fails for contingent workers unless it also handles short contracts, sponsor ownership, and automatic removal when the engagement ends.
What gets overlooked in offboarding and revocation?
The common failure is to remove the visible user account while leaving behind the access material that actually keeps the path alive. That includes API tokens, OAuth grants, SSH keys, certificates, refresh tokens, service credentials, shared mailbox access, and device registrations. If any of those remain valid, the person may still be able to reach systems even after the directory account is disabled.
That is why offboarding needs a full dependency check, not just a directory action. Teams should verify where the account authenticated, what sessions remain active, which third-party apps were authorised, and whether privileged entitlements were inherited through nested groups or role mappings. Joiner-Mover-Leaver (JML) Guide is a practical starting point for automating those lifecycle steps, while NHI Lifecycle Management Guide reinforces the same lifecycle principle for provisioning, rotation, and offboarding of access-bearing material.
Risk and Threat Considerations
Lifecycle gaps are attractive because they create standing access after the employment or contract relationship has ended. That is a direct exposure for unauthorised access, privilege abuse, and persistence, especially when tokens or service credentials are not revoked with the same urgency as the primary user account.
Failure mechanism: The organisation disables or deletes the directory identity but fails to revoke downstream access paths, so an attacker or former insider can continue using valid tokens, sessions, keys, or connected accounts.
Impact: Exposed systems can be reached after offboarding, access can survive role changes, and stale privileges can be reused for data theft, fraud, or lateral movement. Internet Archive breach 2024 and Cloudflare Thanksgiving breach 2023 both illustrate how unrevoked tokens and service accounts can extend compromise beyond the original event.
Standards & Framework Alignment
This section maps relevant standards and security frameworks to the operational risks and controls described in this guidance.
NIST SP 800-53 Rev 5 and CIS Controls v8 set the technical controls, while ISO/IEC 27001:2022 defines the regulatory obligations.
| Framework | Control / Reference | Relevance |
|---|---|---|
| NIST SP 800-53 Rev 5 | IA-5 — Authenticator Management | Covers lifecycle handling of credentials, tokens, and revocation after offboarding. |
| AC-2 — Account Management | Directly governs provisioning, disabling, and removal of accounts across the joiner-leaver lifecycle. | |
| AC-6 — Least Privilege | Supports role-based provisioning and reducing excess access during onboarding and role changes. | |
| Recommendation — Automate credential revocation and rotation when employment or access ends. Enforce timely account creation, modification, disabling, and removal through approved workflow. Limit each identity to the minimum access required for its current job role. | ||
| ISO/IEC 27001:2022 | A.5.18 — Access rights | Addresses provisioning, review, and removal of access rights across the identity lifecycle. |
| Recommendation — Review and revoke access rights promptly when roles change or end. | ||
| CIS Controls v8 | CIS-5 — Account Management | Covers account provisioning, removal, and lifecycle governance for users and contractors. |
| Recommendation — Centralise account lifecycle control and disable stale accounts without delay. | ||
Practitioner Guidance
What to prioritise: Treat offboarding as the highest-risk lifecycle step because it is the point where legitimate access should become invalid immediately. If the person had privileged, federated, or third-party access, make revocation of tokens, sessions, and connected apps part of the same workflow as account disablement.
What to verify: Confirm that the joiner source of truth, role mapping, and termination trigger all line up. A clean directory record is not enough if downstream systems still trust cached sessions, old group membership, or app-specific credentials. For high-value roles, require evidence that the revocation actually propagated before the exit ticket is closed.
Common mistake: Teams often optimise for speed of onboarding and treat offboarding as a manual afterthought. That creates access creep, orphaned entitlements, and delayed revocation, which are exactly the conditions that turn routine lifecycle administration into a security issue.
Practitioner takeaway: The best lifecycle programmes do not just create and remove accounts, they continuously keep access aligned to current authority, and they assume every forgotten token or lingering entitlement is part of the attack surface.