User lifecycle management controls are failing at scale in SaaS

At a glance

What this is: This is a vendor comparison of BetterCloud and JumpCloud for SaaS user lifecycle management, with the key finding that lifecycle controls still hinge on how cleanly access is provisioned, adjusted, and revoked across systems.

Why it matters: It matters because IAM teams are still judged on whether access changes happen at the right moment and in the right scope, which is central to both human identity governance and NHI lifecycle discipline.

By the numbers:

• One platform is described as suited for enterprises with 1000+ employees, while the other is positioned for businesses with 50 to 1000 employees.

Context

User lifecycle management is the discipline of onboarding, changing, and offboarding identities without leaving access behind or removing the wrong access too early. In SaaS environments, that problem spans HR records, directories, app entitlements, and conditional access decisions, so a lifecycle tool is only as strong as the transition logic it can enforce.

Zluri’s article frames BetterCloud and JumpCloud as different answers to the same governance problem: how to move access cleanly through joiner, mover, and leaver states. The underlying issue for IAM teams is not feature count, but whether identity transitions are governed end to end across SaaS and directory dependencies.

Key questions

Q: What breaks when device lifecycle management is not tied to identity governance?

A: When device lifecycle management is isolated from identity governance, organisations lose the ability to prove who used the device, what access it carried, and whether retirement actually removed trust. That creates residual access risk through cached credentials, retained software permissions, and incomplete offboarding. The control failure is usually not the asset record itself, but the missing link between device state and identity state.

Q: When should IAM teams prioritise offboarding over onboarding automation?

A: IAM teams should prioritise offboarding whenever residual access creates a greater security risk than delayed provisioning. If departing users can still reach SaaS apps, group memberships, or shared files, then revocation discipline is the higher-value control. Automation only helps when the removal path is as dependable as the creation path.

Q: What are the signs that SaaS lifecycle management is failing?

A: Common warning signs include dormant accounts that still authenticate, old API or OAuth tokens that remain valid, external shares that no one owns, and privileged apps that have not been reviewed for a long time. Another indicator is when security teams cannot quickly explain which identities still need access and which ones should have been removed or disabled already.

Q: How do access reviews differ from lifecycle offboarding in IAM?

A: Access reviews validate whether existing access is still justified, while lifecycle offboarding removes access when the identity relationship has ended. Reviews are retrospective and periodic; offboarding is event-driven and executional. In practice, both are needed, but offboarding is the control that prevents review from becoming a post-incident cleanup exercise.

Technical breakdown

Why lifecycle automation fails when HR, directory, and SaaS data drift

Lifecycle automation depends on a consistent source of truth for identity state, role, and employment status. When HR updates, directory attributes, and SaaS entitlements do not reconcile quickly, provisioning becomes too broad on the way in and too slow on the way out. That creates stale access, duplicate access paths, and manual cleanup work that defeats the purpose of lifecycle governance. In practice, the failure is not the workflow itself, but the gap between identity change events and entitlement enforcement across systems.

Practical implication: map every onboarding, mover, and leaver trigger to a single governed identity state before automating access changes.

How conditional access and group-based permissions change lifecycle control

Group-based access and conditional access are lifecycle controls because they determine who inherits access and under what circumstances that access remains valid. Group assignment is efficient, but it also turns poor role modelling into broad entitlement spread. Conditional access adds context, such as device or network posture, but it does not replace lifecycle hygiene if old access is never removed. The technical challenge is to keep access decisions tied to current identity state rather than letting inherited groups become permanent access shortcuts.

Practical implication: review group templates and conditional policies together so entitlement inheritance does not outlive the employee role that justified it.

Why deprovisioning speed matters more than provisioning speed

Provisioning is visible, but deprovisioning is where lifecycle programmes most often fail security tests. The article’s emphasis on automated offboarding reflects a common truth: access that remains after departure creates a larger attack window than slow onboarding ever does. In SaaS, revocation must cover application accounts, group memberships, and any delegated workflow or file access that was granted during employment. If revocation is partial, the identity still exists in enough systems for misuse or accidental exposure.

Practical implication: treat offboarding as a revocation chain, not a single click, and verify that every app and group has been closed.

Threat narrative

Attacker objective: Exploit lingering SaaS access that should have been removed during offboarding or role transition.

1. entry: An employee lifecycle event such as departure or role change creates the first chance for access to become mis-scoped if upstream identity data is stale or incomplete.
2. escalation: Excessive group membership or delayed revocation preserves access beyond the approved business need, allowing continued use of SaaS permissions after the role has changed.
3. impact: Residual access can expose SaaS data, files, and administrative functions after the identity should have been reduced or removed.

Breaches seen in the wild

• Coupang Signing Key Breach: Unrevoked signing key credentials expose 33.7 million records after employee offboarding failure at Coupang.
• Dropbox Sign breach 2024: A compromised back-end service account gave attackers Dropbox Sign customer data, including API keys, OAuth tokens and MFA information.

Read and download The State of NHI & AI Agent Breach Report 2026, covering 150+ breaches impacting Non-Human Identities including AI Agents.

NHI Mgmt Group analysis

Lifecycle controls fail when identity state changes faster than entitlement cleanup. The article shows that the real governance problem is not whether a tool can automate onboarding or offboarding, but whether it can keep SaaS access synchronized with the employee state that justified it. When HR, directory, and application data drift apart, lifecycle governance becomes an approximation instead of an enforcement model. Practitioners should treat identity state reconciliation as the core control.

Standing access after role change is a governance defect, not an efficiency issue. The mover problem is often overlooked because the user is still legitimate, yet their access intent has changed. That is where group inheritance, old app assignments, and conditional policies can quietly preserve permissions that no longer match the role. IAM teams should view mid-life entitlement cleanup as a primary control surface, not a secondary admin task.

Offboarding discipline now matters across human and non-human identities. The same lifecycle logic that removes employee SaaS access also applies to service accounts, API keys, and tokens that outlive the business relationship or workflow they support. Lifecycle offboarding debt: access that persists because revocation is not tied tightly enough to identity end state. The practical consequence is that revocation must be treated as an identity governance event, not an operational courtesy.

Conditional access cannot compensate for weak entitlement hygiene. Contextual controls reduce exposure only when the underlying permission model is already clean. If users remain overentitled, device and network checks narrow risk at the edge but do not fix the underlying access problem. IAM programmes should therefore separate policy enforcement from entitlement correction and measure both independently.

The market is converging on lifecycle governance as a control plane, not a workflow feature. The article reflects a broader category shift in which buyers are evaluating whether lifecycle tools merely automate tasks or actually enforce governed access transitions. That distinction matters because automation without lifecycle assurance scales mistakes just as effectively as it scales speed. Practitioners should judge platforms by whether they reduce access residue across the full joiner, mover, leaver chain.

From our research library:

• Only 20% have formal processes for offboarding and revoking API keys, and even fewer have procedures for rotating them, according to the Ultimate Guide to NHIs.
• Read next: NHI Lifecycle Management Guide

What this signals

Lifecycle governance is becoming the real boundary between efficient IAM and residual-access risk. Teams that focus only on provisioning speed will miss the larger control question: whether entitlement removal keeps pace with role changes and departures. That is where most lifecycle programmes leak security value, especially in SaaS estates with many app-specific permissions.

Offboarding debt now spans people, applications, and delegated access paths. The useful mental model is not a single deprovisioning event but a chain of revocation obligations across accounts, groups, files, and downstream integrations. If any one link survives, the identity still has a usable footprint.

Lifecycle offboarding debt: when access persists after the business reason for access has ended, the programme has shifted from governance to cleanup. IAM leaders should track residual permissions as a first-class risk metric, not as an afterthought in audit season.

For practitioners

• Define the lifecycle source of truth Make HR, directory, and SaaS entitlement data converge on one governed identity state before automating joiner, mover, and leaver actions.
• Tighten mover workflows before expanding onboarding Audit role changes for inherited access that persists after transfers, promotions, or department moves, then remove obsolete entitlements as part of the same workflow.
• Break offboarding into revocation checkpoints Verify that app accounts, group memberships, delegated access, and file-sharing permissions all close when a user leaves, instead of assuming one workflow step is enough.
• Separate conditional access from entitlement cleanup Use conditional policies to reduce exposure at access time, but do not rely on them to correct stale roles or overprovisioned SaaS permissions.
• Measure residual access after lifecycle events Track how many permissions remain 24 hours, 7 days, and 30 days after a joiner, mover, or leaver event so you can see where lifecycle control is breaking down.

Key takeaways

• Lifecycle controls fail when identity changes are not reconciled quickly enough across HR, directory, and SaaS systems.
• The article’s comparison is really about whether access transitions are enforced cleanly at join, move, and leave moments, not about automation alone.
• IAM teams should treat offboarding, mover cleanup, and entitlement reconciliation as the core controls for reducing residual access in SaaS.

Key terms

• User Life Cycle Management: User life cycle management is the end-to-end process of creating, updating, reviewing, and removing user identities and access across enterprise systems. It links identity governance to employee onboarding, role changes, and offboarding so access stays aligned with job responsibilities and business need.
• Off-boarding: Off-boarding is the process of removing a departing user’s access, credentials, and related entitlements from the environment. In mature IAM programmes, it also includes reviewing sessions, shared secrets, delegated roles, and linked non-human identities so that exit events do not leave behind hidden access paths.
• Mover Workflow: A mover workflow is the identity process used when a user changes roles, teams, or departments while staying employed. Strong mover workflows remove outdated access, downgrade obsolete privilege, and revalidate new need at the same time, rather than only provisioning the next role.
• Entitlement Inheritance: The way access granted at one layer, such as a group, role, or policy, flows into additional permissions at another layer. It is central to modern IAM risk because the final access outcome can differ materially from the original assignment.

Deepen your knowledge

NHI governance, identity lifecycle management, and secrets management are core topics in our NHI Foundation Level course, the industry's only accredited NHI security programme. If you are building or maturing an IAM programme, it is worth exploring.