Joiner-mover-leaver automation closes lifecycle gaps in hybrid IAM

At a glance

What this is: NHI Mgmt Group's analysis, drawing on Cayosoft's blog post: joiner-mover-leaver automation reduces orphaned access, privilege creep, and audit gaps by tying identity changes to policy-driven lifecycle controls.

Why it matters: IAM and IGA teams need this because lifecycle failures affect both human accounts and non-human identities, and missed offboarding or role changes quickly become security and compliance problems.

By the numbers:

• Done manually, that process can take an IT admin 30 minutes or more per user.

Context

Joiner-mover-leaver is the control plane for identity change: it determines how access is created, adjusted, and removed when people move through an organisation. The security gap appears when those changes depend on tickets, email, or memory instead of a governed workflow tied to authoritative events. In hybrid environments, that gap extends across directory services, cloud collaboration platforms, and the identities that never appear in HR at all, including service accounts and automation accounts.

Manual lifecycle handling breaks because identity state changes faster than people can reconcile it. A role transfer, a termination, or a contractor expiry can leave old permissions behind unless the offboarding model is linked to the systems that actually carry access. That is why lifecycle governance has to cover both human and non-human identities, not just employee joiners and leavers.

The practical issue is not whether access changes happen, but whether they happen consistently enough to support identity governance across the estate. When lifecycle events are handled unevenly, organisations accumulate stale entitlements, hidden admin rights, and evidence gaps that show up later in audits or incidents.

Key questions

Q: What should teams do first when a user leaves and access must be revoked?

A: Start with an immediate full access shutdown for the user’s active accounts, then disable SSO, VPN, email, and privileged sessions, and revoke tokens, certificates, and password reset paths. Next, transfer ownership of shared accounts, remove group memberships, and confirm the deprovisioning action against HR or manager notification so no lingering access remains.

Q: Why do mover events create privilege creep so quickly?

A: Mover events create privilege creep because each internal change usually adds new access while removal is delayed, incomplete, or forgotten. Over time, the identity accumulates permissions from multiple roles, projects, and temporary coverage tasks. Without visible current access and explicit offboarding logic for old entitlements, the accumulation becomes normalised.

Q: How should organisations govern identity lifecycle changes across users and non-human accounts?

A: They should use the same governance discipline for both, but with actor-specific execution. Joiner, mover, and leaver events should trigger authoritative provisioning and revocation, while service accounts and tokens should be tied to workload ownership and expiry. The goal is to prevent access from outliving the business need that created it.

Technical breakdown

How joiner, mover, and leaver events map to access changes

Joiner-mover-leaver workflows convert identity events into downstream access actions. A joiner event typically creates accounts, assigns baseline groups, and provisions application access. A mover event should remove no-longer-needed permissions before granting new ones, because role changes are where privilege creep starts. A leaver event revokes access, disables or removes accounts, reclaims licenses, and clears connected entitlements. In a hybrid stack, the mechanism only works when the event source is authoritative and the target systems are integrated tightly enough to enforce the policy consistently.

Practical implication: Model each HR-triggered event as a controlled entitlement change, not as an informal service desk task.

Why manual offboarding leaves orphaned accounts behind

Orphaned accounts form when deprovisioning depends on handoffs between HR, managers, and IT. Each extra step introduces delay, and each delay increases the chance that an account, mailbox, VPN session, or cloud role survives after employment or contract end. The risk is compounded in hybrid environments because access often exists in more than one directory or admin plane, so revocation has to happen everywhere at once. When a departed identity still has active credentials, the account becomes an unattended access path rather than a record of past employment. See the Joiner-Mover-Leaver (JML) Guide.

Practical implication: Treat offboarding as an atomic revocation problem across all connected systems, not as a single directory event.

How privilege creep develops in mover workflows

Privilege creep is the gradual accumulation of access that no longer matches a person’s current role. It often starts with one retained group membership, then expands through nested groups, delegated admin rights, and direct cloud role grants that bypass the clean joiner-mover-leaver path. The issue is not just excess access at one moment, but the lack of a reliable removal step when a role changes. Once access drifts, standard provisioning logic can keep adding permissions while never removing the old ones, which turns role change into long-term entitlement inflation. See the Access Reviews and Certification Guide.

Practical implication: Build mover logic that removes prior-role access before adding the new-role entitlements.

Threat narrative

Attacker objective: Use unrevoked access to reach systems, data, or administrative functions that should have been closed when the identity changed.

1. Entry occurs when a stale account, lingering admin grant, or unused cloud entitlement remains active after a role change or departure.
2. Privilege escalation follows when the retained access is broader than the current role and can be used to reach systems the identity no longer needs.
3. Impact arrives as unauthorized access, audit failure, or lateral movement from an account that should have been removed from the environment.

Breaches seen in the wild

• Twitter source code leak 2023: Twitter source code and internal tools were posted to GitHub by "FreeSpeechEnthusiast" and stayed public for months before a 2023 takedown.

Read and download The State of NHI & AI Agent Breach Report 2026, covering 200+ breaches impacting Non-Human Identities including AI Agents.

NHI Mgmt Group analysis

JML is now a governance system, not a provisioning script. The old model treated joiner-mover-leaver as a ticket workflow for account setup and removal. That framing no longer holds when the same process must govern people, service accounts, app registrations, workload identities, and privileged cloud roles. The discipline is really about keeping access continuously aligned to business state, which means lifecycle control has to sit inside identity governance rather than beside it. Practitioners should treat JML as an enterprise control, not an admin convenience.

Manual lifecycle handling creates identity drift that security teams only see after the fact. Drift is not just excess privilege at provisioning time, it is the gap between what the directory says and what the business relationship actually is. That gap grows whenever movers retain old entitlements, contractors outlive their end dates, or offboarding depends on a human remembering every downstream system. The result is stale access that survives normal review cycles and turns review into discovery instead of prevention. Teams need to think of drift as a standing governance defect, not a housekeeping issue.

Least privilege fails when access is defined once and never re-evaluated. JML processes were designed for stable role assumptions. That assumption fails when roles change repeatedly, permissions accumulate through group nesting and delegated administration, and the identity estate includes accounts that never generate HR events. The implication is that least privilege cannot be treated as a one-time provisioning target; it has to be preserved through lifecycle state changes and continuous review.

Access review alone cannot compensate for broken lifecycle governance. Reviews are retrospective, but JML failures are operational. If the offboarding step never fires or the mover step never removes prior access, certification just confirms a broken state after it has already existed long enough to matter. The stronger control is the one that removes access when the business event occurs, then uses review to verify the decision trail. Practitioners should close the gap at the event source, not rely on later certification to catch what was missed.

Human and non-human identity governance now share the same failure mode: access that outlives accountability. Whether the subject is an employee, a contractor, a service account, or an automation identity, the control problem is the same when ownership changes but access persists. That is why lifecycle programmes need the same rigor across human IAM, NHI governance, and privileged access management. The operating principle is simple: if the relationship changed, the access state must change with it.

From our research library:

• 97% of NHIs carry excessive privileges, increasing unauthorised access and broadening the attack surface, according to the Ultimate Guide to NHIs.
• Read next: Access Reviews and Certification Guide

What this signals

Continuous lifecycle control is becoming the real least-privilege mechanism. Periodic certification helps, but it does not close the gap between a role change and the next review cycle. The stronger model is event-driven entitlement removal with continuous drift detection, so access changes when the business relationship changes, not weeks later.

Hybrid identity estates expose the blind spot between HR events and machine-held access. The same governance model that handles employees must now account for app registrations, workload identities, and automation accounts that never appear in HR systems. That is where lifecycle programmes fail first, because access persists outside the event stream that was supposed to govern it.

Privilege creep is the named failure mode that JML programmes must absorb. According to the Ultimate Guide to NHIs, 97% of NHIs carry excessive privileges, increasing unauthorised access and broadening the attack surface. That figure matters here because the same accumulation pattern appears when mover workflows leave old rights in place and no one owns the cleanup.

For practitioners

• Map every identity trigger to an access outcome Define exactly what should happen for hires, transfers, promotions, leaves, terminations, contractor expiry, and role removal, then bind those events to downstream account and entitlement changes. See the IAM and IGA Basics.
• Extend offboarding beyond employee accounts Create explicit ownership and revocation paths for service accounts, app registrations, workload identities, shared mailboxes, and automation identities that never appear in HR records.
• Remove prior-role access before adding new access Design mover workflows to revoke old group memberships, delegated admin rights, and direct cloud roles first, then provision the replacement access set for the new role.
• Set deprovisioning targets that your logs can prove Define the maximum delay between a leaver event and completed revocation, then require audit evidence that shows when each account, license, and entitlement was removed.
• Review privileged and delegated access on a separate cadence Run a more frequent review cycle for admin roles, delegated admin assignments, and break-glass access than for standard user access, because these permissions create disproportionate risk.

Key takeaways

• Manual joiner-mover-leaver handling leaves organisations exposed to orphaned accounts, privilege creep, and incomplete audit evidence.
• Hybrid environments make lifecycle mistakes harder to spot because access is split across directories, cloud services, and non-human identities.
• The most effective control is event-driven revocation tied to business change, backed by separate review of privileged access.

Related NHI Mgmt Group resources: IAM and IGA Basics · Joiner-Mover-Leaver (JML) Guide · NHI Lifecycle Management Guide · Access Reviews and Certification Guide

Key terms

• Joiner Mover Leaver: Joiner Mover Leaver is the identity lifecycle process for creating, changing, and removing access as people enter, change roles, or leave an organization. It governs provisioning, modification, and deprovisioning across systems, ensuring access matches current job needs and reducing orphaned accounts, privilege creep, and residual access risk.
• Identity Lifecycle Management: Identity Lifecycle Management is the process of creating, changing, reviewing, and removing digital identities across their full lifespan. It governs how users, service accounts, API keys, certificates, and other NHIs are provisioned, updated, certified, and deprovisioned to keep access aligned with business need, policy, and risk.
• Privilege Creep: Privilege creep is the gradual accumulation of access rights beyond what an identity actually needs. It usually happens when permissions are added for convenience and never removed. For NHIs, privilege creep expands blast radius and makes old credentials far more dangerous than their original purpose suggests.
• Orphaned Account: An orphaned account is an identity that remains active without a clear owner or business purpose. These accounts are dangerous because they often escape review, retain unnecessary access, and provide attackers with low-friction entry points into otherwise governed environments.

Deepen your knowledge

NHI governance, agentic AI identity, and machine identity lifecycle are core topics in our NHI Foundation Level course, the industry's only accredited NHI security programme. If you are building or maturing an IAM programme, it is worth exploring.