Topic starter
17/08/2026 4:40 pm
TL;DR: Late or manual onboarding, offboarding, and role changes turn identity lifecycle management into a security exposure, not just an operations problem, according to Soffid. With 71% of organisations reporting at least one identity-related breach in the past year, the case for automated lifecycle controls is no longer optional.
Editorial analysis by NHI Mgmt Group, based on content published by Soffid: “Why automating onboarding, offboarding and role changes is the foundation of any IAM strategy”.
By the numbers:
- 71% of organizations have suffered at least one identity-related security breach in the past 12 months, with an average of 3 identity attacks per year, according to a Sophos survey cited by Soffid.
Key questions
Q: What breaks when identity lifecycle management is manual in Active Directory?
A: Manual lifecycle management breaks when account creation, group changes, and offboarding rely on tickets, spreadsheets, and memory.
Q: Why do delayed offboarding processes create security risk?
A: Delayed offboarding creates security risk because access can remain active after the business relationship ends.
Q: How do organisations know whether identity lifecycle automation is actually working?
A: They should measure execution coverage, revocation delay, and audit completeness across the full app estate, not just in the IdP.
Practitioner guidance
- Automate joiner-mover-leaver workflows Tie onboarding, role changes, and offboarding to authoritative HR or source-of-truth events so access updates happen as part of the lifecycle, not after a manual ticket queue.
- Eliminate orphaned accounts Create explicit deprovisioning triggers for departures, inactive identities, and contract end dates so abandoned accounts do not retain access longer than necessary.
- Remove temporary access on expiry Treat temporary privileges as time-bounded exceptions and enforce automatic revocation when the business need ends, rather than waiting for manual cleanup.
Bottom line: Manual identity lifecycle handling leaves access behind the business state, which is how stale permissions and orphaned accounts become security exposure.
Explore further
View Full Forum → | NHI Foundation Course → | Our Services → | Read the full analysis →
17/08/2026 4:45 pm
Identity lifecycle drift is a governance failure, not an administrative delay. When onboarding, offboarding, and role changes are handled late, the organisation is no longer governing access against current business reality. The problem is structural because permissions outlive the need that justified them. For IAM and IGA teams, that means lifecycle latency should be treated as exposure, not backlog.
A few things that frame the scale:
- Around 59% of companies report experiencing a data breach related to poorly managed offboarding processes.
A question worth separating out:
Q: What is the difference between access reviews and lifecycle governance?
A: Access reviews are periodic checks that confirm whether existing permissions should remain in place. Lifecycle governance is broader because it controls access at join, move, and leave events, then keeps ownership, expiry, and revocation aligned over time. In practice, organisations need both, but lifecycle controls reduce the volume of review findings.
👉 Read our full editorial: Automating identity lifecycle management is now IAM’s security baseline