Topic starter
06/07/2026 9:43 am
TL;DR: Slow onboarding and incomplete offboarding still create productivity drag, security exposure, and audit pain because many teams rely on tickets, siloed systems, and manual approvals, according to Lumos. Fast lifecycle management is no longer just an IT convenience; it is a control point for least privilege, revocation, and compliance.
Editorial analysis by NHI Mgmt Group, based on content published by Lumos: “How Lumos Speeds Up Onboarding and Offboarding”.
By the numbers:
- Research shows that organizations with structured onboarding programs increase new hire retention by up to 82% and improve productivity by over 50%.
Key questions
Q: What breaks when onboarding and offboarding stay manual?
A: Manual lifecycle handling breaks because access changes become ticket-driven, slow, and inconsistent across systems.
Q: Why do delayed offboarding processes create security risk?
A: Delayed offboarding creates security risk because access can remain active after the business relationship ends.
Q: How do security teams know if lifecycle automation is actually working?
A: Measure removal completeness, not just provisioning speed.
Practitioner guidance
- Map joiner and leaver triggers to identity events Tie HR status changes directly to provisioning and deprovisioning workflows so access changes begin when employment status changes, not when tickets are opened.
- Eliminate directory-only offboarding Confirm that leaver processing removes access from downstream SaaS, cloud, and on-prem applications, not just by disabling the central directory account.
- Document application ownership for every entitlement Assign a responsible owner for each application and entitlement so approvals, reviews, and revocations have a named decision-maker.
Bottom line: Onboarding and offboarding remain bottlenecks because manual handoffs still separate business events from access changes, which weakens both productivity and control.
Explore further
View Full Forum → | NHI Foundation Course → | Our Services → | Read the full analysis →
06/07/2026 9:59 am
Identity lifecycle is now an access control plane, not an HR workflow. When joiner and leaver events are handled through tickets and disconnected approvals, the organisation is no longer governing access at the point of business change. That turns provisioning and revocation into lagging operational tasks instead of live control decisions. Practitioners should treat lifecycle orchestration as a core identity control surface, not an administrative convenience.
A few things that frame the scale:
- Only 20% have formal processes for offboarding and revoking API keys, and even fewer have procedures for rotating them, according to the Ultimate Guide to NHIs.
A question worth separating out:
Q: Who should own onboarding access decisions in a mature IAM programme?
A: Onboarding access decisions should be shared across IAM, application owners, and security, with clear policy ownership and operational execution separated. IAM should govern the rules, application owners should validate access fit, and security should oversee risk-sensitive destinations. That split keeps onboarding from becoming either fully manual or fully unchecked.
👉 Read our full editorial: Onboarding and offboarding remain the identity lifecycle bottleneck