Joiner-Mover-Leaver provisioning is the identity lifecycle process for creating, updating and removing user access as people join, change role or leave an organisation. It links HR or identity events to account creation, entitlement changes, privilege removal and account disablement, usually through IAM workflows and access reviews.
What Joiner-Mover-Leaver Provisioning Covers
Joiner-Mover-Leaver provisioning is the control plane for identity change over time. It turns employment and role events into the right account state, so access is created, adjusted, or removed when a person joins, changes responsibilities, or exits.
Its value is not just speed. JML ties identity lifecycle events to entitlement decisions, so access follows the business relationship rather than lingering after the need has passed. That is what makes it a governance process as much as a technical workflow.
Why JML Matters in Identity Governance
JML is where many access problems either get prevented or accumulate. If onboarding is incomplete, movers keep old entitlements and leavers retain paths they should no longer have. That is how privilege creep, orphaned accounts, and stale access persist across an organisation.
Because the process depends on reliable source data and timely workflow execution, it often sits between HR, IAM, and application owners. When those handoffs are inconsistent, the organisation can have a formally defined provisioning process but still fail to enforce it in practice.
For a broader map of lifecycle controls, IAM and IGA Basics provides the surrounding identity governance model, including access reviews and entitlement management.
How Joiner, Mover, and Leaver Events Differ
A joiner event usually means creating a new digital identity footprint, assigning baseline access, and establishing the first policy boundaries. A mover event is more subtle, because it should remove now-invalid access while adding only what the new role requires. A leaver event is the most time-sensitive, because access that remains after departure can become an immediate exposure.
The three stages share the same principle, but not the same risk profile. Joiners are about correct birthright access, movers are about preventing access drift, and leavers are about removing all remaining authority, including sessions and linked credentials where they exist.
The lifecycle view is easier to enforce when organisations treat provisioning as a continuous state transition rather than a one-time ticket. That is why automated triggers, authoritative sources, and access recertification are commonly paired with JML workflows.
When teams want a deeper operational model for the lifecycle itself, the Joiner-Mover-Leaver (JML) Guide shows how the process is typically structured end to end.
Where JML Connects to Access Review and Offboarding
JML is closely related to access review because provisioning alone does not prove that access remains appropriate. Reviews catch drift, confirm role alignment, and expose accounts that no longer match a business need.
It is also tightly linked to offboarding. A good leaver process does not stop at disabling the primary account. It also removes access to cloud apps, code systems, tokens, keys, and any delegated paths that the departed user could still reach.
That is why organisations often combine JML with offboarding controls, SCIM-based automation, and periodic entitlement reconciliation. The goal is to make sure the identity record, the permissions model, and the actual access state stay aligned.
The SCIM and Automated Provisioning Guide is useful where JML is implemented through lifecycle connectors and deprovisioning automation.
Practical Governance Expectations for JML
Well-run JML needs clear ownership, timely triggers, and a defined source of truth. If no single team is accountable for the handoff between HR, IAM, and application administration, lifecycle controls tend to degrade into exceptions and manual cleanup.
Practitioners should also distinguish between removing a user’s access and removing the underlying identity record. In many environments those are separate steps, and leaving either one incomplete can create audit issues or residual exposure.
JML is strongest when it is measured by exception handling, not just by completed tickets. Late deprovisioning, stale entitlements, and failed connector actions are often the signals that the control is weakening.
For policy design, the Access Control Policy Template is a practical reference for joiners, movers, leavers, least privilege, and review cadence.
Risk and Threat Considerations
JML failures create some of the most common identity exposure patterns in enterprise environments. A delayed mover update can leave excessive privileges in place, while a missed leaver action can preserve access for an account that should no longer exist in the business.
Failure mechanism: The control breaks when role changes or departures are not propagated quickly enough across directories, SaaS platforms, sessions, tokens, and privileged entitlements.
Impact: Attackers, insiders, or former staff may retain access long enough to exfiltrate data, alter systems, or use dormant paths that defenders assumed were already closed.
Standards & Framework Alignment
This section maps relevant standards and security frameworks to the operational risks and controls described in this guidance.
NIST SP 800-53 Rev 5 and CIS Controls v8 set the technical controls, while ISO/IEC 27001:2022 defines the regulatory obligations.
| Framework | Control / Reference | Relevance |
|---|---|---|
| NIST SP 800-53 Rev 5 | IA-2 — Identification and Authentication (Organizational Users) | JML creates and updates user access tied to organizational identities. |
| AC-2 — Account Management | JML is the lifecycle process for creating, changing, and disabling accounts and entitlements. | |
| PS-4 — Personnel Termination | Leaver processing must remove access when employment or affiliation ends. | |
| Recommendation — Use IA-2 to ensure joiners are uniquely authenticated before access is granted. Apply AC-2 to manage account creation, modification, disabling, and review across the user lifecycle. Use PS-4 to terminate access promptly when personnel leave the organisation. | ||
| ISO/IEC 27001:2022 | A.5.18 — Access Rights | JML governs provisioning, changes, and removal of access rights over time. |
| Recommendation — Define and review access rights so joiner, mover, and leaver changes are approved and tracked. | ||
| CIS Controls v8 | CIS-5 — Account Management | JML is a core account-management lifecycle control for users and privileged access. |
| Recommendation — Implement CIS-5 to provision, modify, and remove accounts in line with role changes and departures. | ||
Practitioner Guidance
Governance implication: JML should be owned as a lifecycle control, not a help desk task. The practical question is whether the organisation can prove that every join, move, and leave event reaches the right downstream systems within an agreed window.
Practitioner takeaway: The best JML programmes are built to remove old access first, then add only what the new state requires, because lifecycle drift is easier to prevent than to clean up later.
Related resources from NHI Mgmt Group
- How do organisations reduce manual provisioning errors across joiner, mover, and leaver workflows?
- Why does automated provisioning reduce access risk in joiner-mover-leaver processes?
- Why do service accounts and API keys complicate joiner-mover-leaver processes?
- How can organisations use access profiles in joiner-mover-leaver workflows?