Topic starter
08/07/2026 7:07 pm
TL;DR: Mid-sized companies often struggle with manual Joiner-Mover-Leaver processes that delay onboarding, accumulate excess access, and leave orphan accounts behind, according to OpenIAM. The operational problem is less about headcount than about lifecycle governance that cannot keep pace with role changes, SaaS sprawl, and offboarding.
Editorial analysis by NHI Mgmt Group, based on content published by OpenIAM: “The Identity Lifecycle Problem in Mid-Sized Companies”.
Key questions
Q: What breaks when joiner-mover-leaver workflows are mostly manual?
A: Manual workflows create delay, inconsistency, and missed revocations.
Q: Why do role changes create so much access creep?
A: Role changes create access creep because organisations are faster at adding new access than removing old access.
Q: How do security teams know whether offboarding is actually working?
A: Security teams should measure completion, not process start.
Practitioner guidance
- Define authoritative lifecycle triggers Tie join, move, and leave events to a single source of truth so provisioning and revocation follow business status rather than ad hoc tickets.
- Remove access on role change Build mover workflows that recalculate entitlements and explicitly remove permissions that no longer match the person’s current job attributes.
- Verify downstream offboarding Check that leaver processing disables directory access, closes SaaS entitlements, revokes tokens and sessions, and covers privileged tools and shared accounts.
Bottom line: Mid-sized firms do not just have a provisioning problem. They have a lifecycle governance problem that shows up as slow onboarding, stale entitlements, and incomplete removal.
Explore further
View Full Forum → | NHI Foundation Course → | Our Services → | Read the full analysis →
08/07/2026 7:31 pm
Identity lifecycle maturity is the real control plane for mid-sized IAM. Mid-sized firms do not fail because JML is conceptually hard; they fail because lifecycle events are not enforced as governed identity changes. When access is spread across SaaS, directories, and local admin consoles, the programme no longer has a single authoritative moment for grant, change, and revoke. The practitioner conclusion is that lifecycle maturity is the difference between access administration and access governance.
A question worth separating out:
Q: What is the difference between birthright access and overprovisioning?
A: Birthright access is the minimal, predefined access a role needs on day one. Overprovisioning is when extra permissions are added for convenience, speed, or uncertainty and then never removed. The first supports consistent onboarding. The second creates long-term privilege sprawl and makes later governance much harder.
👉 Read our full editorial: Identity lifecycle maturity is the real mid-market IAM gap