User lifecycle management exposes the gaps in SaaS access governance

At a glance

What this is: This is a vendor analysis of user lifecycle management, with the main finding that onboarding, offboarding, and access changes must be automated to keep SaaS access aligned with employee state.

Why it matters: It matters because lifecycle drift affects human IAM, but the same governance pattern also informs how teams handle NHI entitlements and autonomous access chains.

👉 Read Zluri's guide to user lifecycle management and SaaS access control

Context

User lifecycle management is the process of granting, changing, and removing access as people move through joiner, mover, and leaver stages. In identity programmes, the real issue is not speed alone but whether access state stays aligned with employment state across SaaS applications, approvals, and revocation.

That matters for IAM and IGA teams because delayed offboarding, manual role changes, and inconsistent request handling create entitlement drift. The same governance pattern shows up later in NHI and agentic AI programmes, where access must also be corrected as the actor's role or authority changes.

Key questions

Q: How should organisations automate user lifecycle management without losing control?

A: Automate the workflow, not the decision rule. Use role, department, and HR status as triggers, but keep approval logic, entitlement mapping, and completion checks explicit. The goal is to remove manual delay while preserving accountability for what gets granted, modified, and revoked across each SaaS application.

Q: Why do mover events create more access risk than onboarding events?

A: Mover events create risk because they often add new access without removing old access. That produces privilege creep, where the user's entitlement set grows beyond current job needs. The problem is cumulative, so governance must focus on revocation as much as provisioning.

Q: What breaks when offboarding is not fully deprovisioned?

A: Former employees can retain valid routes into SaaS applications, shared tools, or delegated permissions after departure. That leaves the organisation exposed to data loss, misuse, and internal abuse. Offboarding only works when every account and entitlement is verified as removed before the case is closed.

Q: Who should own access decisions in a self-service app catalog?

A: IT should own the policy, application owners should own risk acceptance, and approvers should own the access decision within defined boundaries. Self-service does not remove governance. It simply moves the request path into a controlled catalog where approval, visibility, and review are easier to enforce.

Technical breakdown

Onboarding workflows and day-one access

Onboarding workflows map a new employee to the applications, groups, and permissions required for first-day productivity. In practice, the workflow orchestration layer pulls from role, department, or seniority signals, then submits the access actions in sequence. The important technical point is that the workflow is not the control objective. The objective is consistent entitlement provisioning with the right approvers, application mappings, and audit trail so access is created once and created correctly.

Practical implication: standardise role-based onboarding templates so access requests do not become one-off manual approvals.

Mover events and entitlement revocation

Mover events are where user lifecycle governance usually breaks. When an employee changes role, location, or team, old access should be removed as new access is granted. If the HR system feeds the IAM workflow, the control depends on event freshness, attribute accuracy, and downstream enforcement in SaaS apps. Without that, organisations accumulate privilege creep, where users retain permissions that no longer match their job function.

Practical implication: tie HR change events to revocation logic so old access is removed when new access is added.

Offboarding and deprovisioning as a security control

Offboarding is the final lifecycle stage and the one most directly linked to breach risk. Deprovisioning should revoke access across accounts, apps, and shared services, not just disable a primary login. The technical challenge is coverage. If the workflow misses a SaaS app, token, or delegated permission, the former employee still has an active route into corporate data. Strong offboarding therefore depends on inventory, dependency mapping, and verified completion of revocation tasks.

Practical implication: require offboarding completion checks that confirm every app and entitlement has been revoked before closure.

NHI Mgmt Group analysis

Lifecycle governance fails when access state and employment state drift apart. User lifecycle management is supposed to keep entitlements aligned with role changes, departures, and approvals. When that alignment depends on manual cleanup or partial system integration, the control becomes symbolic rather than effective. The practitioner conclusion is simple: lifecycle governance only works when the identity record stays authoritative across the full access chain.

Offboarding is the highest-value control point in SaaS identity governance. The article's own examples show that lingering access after departure is treated as a security failure, not just an operational inconvenience. That reflects the broader NHI and IAM pattern where revocation is often harder than provisioning, yet carries the greater risk if missed. Practitioners should treat completion of revocation as a control objective, not an administrative task.

Role changes expose privilege creep faster than joiner events do. Onboarding is visible and measurable, but mover events quietly accumulate excessive access if entitlements are not removed as quickly as they are added. This is why lifecycle governance has to be continuous rather than episodic. The practitioner conclusion is that entitlement drift should be monitored as a standing governance signal.

Self-service access only works when it is bounded by policy and review. Letting employees request applications from a catalog can reduce delay, but it also shifts pressure onto the accuracy of app metadata, approval routing, and app-owner accountability. A self-service model is not a relaxation of governance. It is a different way of enforcing the same decision model at scale, and practitioners need to keep that boundary explicit.

From our research:

• 71% of NHIs are not rotated within recommended time frames, increasing the risk of compromise over time, according to the Ultimate Guide to NHIs.
• Only 5.7% of organisations have full visibility into their service accounts, which is why lifecycle workflows need complete entitlement inventories before deprovisioning can be trusted.
• For the lifecycle angle, see NHI Lifecycle Management Guide for the provisioning, rotation, and offboarding controls that map most closely to this problem.

What this signals

Joiner, mover, and leaver governance will keep converging across human and non-human identities. The same control logic that manages employee lifecycle transitions now has to support service accounts, application identities, and eventually autonomous actors. Organisations that still treat lifecycle as an HR-admin problem will miss the broader entitlement drift problem in the access layer.

With 96% of organisations storing secrets outside secrets managers in vulnerable locations including code, config files, and CI/CD tools, per the Ultimate Guide to NHIs, access lifecycle maturity is becoming a baseline security requirement rather than an administrative convenience.

Lifecycle visibility is the new control boundary. If teams cannot see which identities are active, who owns them, and what should be revoked when conditions change, they cannot prove that governance is working. That is where lifecycle management stops being a workflow feature and becomes a security programme dependency.

For practitioners

• Standardise joiner, mover, and leaver playbooks Map each employee state change to a predefined entitlement workflow so onboarding, role changes, and offboarding follow the same approval and execution pattern across all core SaaS applications.
• Tie HR events to revocation triggers Use HR system changes as the authoritative trigger for access removal and entitlement updates, then verify that downstream SaaS accounts, groups, and app-specific permissions are actually closed out.
• Require offboarding completion evidence Do not close a leaver case until you have proof that all known accounts, tokens, and delegated app permissions have been revoked, including any access that sits outside the primary identity system.
• Review self-service app catalog boundaries Limit what appears in the app catalog to approved applications with known owners, risk ratings, and review paths so request speed does not outpace governance.

Key takeaways

• User lifecycle management is really an entitlement governance problem disguised as employee administration.
• Offboarding and mover-event revocation are the highest-risk points because lingering access creates privilege creep and stale exposure.
• Programme maturity depends on verifiable revocation, not just automated provisioning or a polished self-service workflow.

Key terms

• User Lifecycle Management: User lifecycle management is the process of granting, changing, and removing access as a person moves through joiner, mover, and leaver stages. In identity programmes, it is the control layer that keeps entitlements aligned with employment state and business need across systems and applications.
• Privilege Creep: Privilege creep is the accumulation of excess access over time when older permissions are never removed. It happens when roles change but entitlements do not, leaving users with more access than their current job requires and expanding the organisation's attack surface.
• Deprovisioning: Deprovisioning is the process of removing a user's access from applications, accounts, and delegated permissions when that access is no longer needed. In mature identity programmes, it is a verified security control, not just an HR termination task.

Deepen your knowledge

NHI governance, agentic AI identity, and machine identity lifecycle are core topics in our NHI Foundation Level course, the industry's only accredited NHI security programme. If you are responsible for identity security strategy or NHI governance in your organisation, it is worth exploring.

This post draws on content published by Zluri: Lifecycle Management Revolutionize Your Employee Experience with Zluri’s User Lifecycle Management Platform. Read the original.