Topic starter
25/06/2026 1:32 pm
TL;DR: Identity security programmes must meet organisations at different maturity levels, with examples showing faster joiner, mover, leaver processing, shorter certification cycles, and broader access visibility across large enterprises, according to SailPoint. The operational lesson is that lifecycle automation and access governance remain the real determinants of control at scale.
Editorial analysis by NHI Mgmt Group, based on content published by SailPoint: “The identity security journey: Meeting customers where they are”.
Key questions
Q: What breaks when joiner-mover-leaver workflows are mostly manual?
A: Manual workflows create delay, inconsistency, and missed revocations.
Q: Why do certification campaigns slow down in large organisations?
A: Certification campaigns slow down when the workflow asks too much of individual reviewers and the interface makes decisions hard to complete quickly.
Q: How do organisations know whether identity lifecycle automation is actually working?
A: They should measure execution coverage, revocation delay, and audit completeness across the full app estate, not just in the IdP.
Practitioner guidance
- Map manual lifecycle handoffs Identify where joiner, mover and leaver events still depend on ticketing, spreadsheets or ad hoc approvals, then rank those steps by delay and error rate.
- Build a current access inventory Unify request, certification and entitlement data so reviewers are working from one authoritative view of access instead of reconciling multiple records.
- Automate JML triggers from HR Connect HR status changes and role updates directly to provisioning and deprovisioning workflows across core applications and directory services.
Bottom line: Identity security journeys break down where lifecycle events still require manual handling across multiple systems.
Explore further
View Full Forum → | NHI Foundation Course → | Our Services → | Read the full analysis →
25/06/2026 3:34 pm
Lifecycle automation is the real maturity boundary in identity security. An identity programme can look complete on paper while still depending on manual joiner, mover and leaver handling behind the scenes. That is where delays, errors and access drift accumulate, especially as organisations add more applications and operating units. The practitioner conclusion is simple: maturity is measured by whether lifecycle events execute consistently without human rework.
A question worth separating out:
Q: How should organisations govern access beyond lifecycle automation?
A: They should separate workflow execution from governance proof. Lifecycle automation can provision or revoke access, but governance must certify that access is still appropriate, enforce separation of duties, and preserve audit evidence. The practical test is whether the organisation can prove who approved access, what changed, and whether the change actually took effect.
👉 Read our full editorial: Identity security journeys still hinge on lifecycle automation