Topic starter
25/06/2026 1:32 pm
TL;DR: Identity security programmes still break down when joiner, mover and leaver steps stay manual across systems, according to SailPoint. Access changes slow, evidence fragments, and governance weakens when automation cannot keep pace with scale.
Editorial analysis by NHI Mgmt Group, based on content published by SailPoint: “The identity security journey: Meeting customers where they are”.
Key questions
Q: Why do certification campaigns slow down in large organisations?
A: Certification campaigns slow down when the workflow asks too much of individual reviewers and the interface makes decisions hard to complete quickly.
Q: How do organisations know whether identity lifecycle automation is actually working?
A: They should measure execution coverage, revocation delay, and audit completeness across the full app estate, not just in the IdP.
Q: What breaks when joiner-mover-leaver workflows are mostly manual?
A: Manual workflows create delay, inconsistency, and missed revocations.
Practitioner guidance
- Map manual lifecycle handoffs Identify where joiner, mover and leaver events still depend on ticketing, spreadsheets or ad hoc approvals, then rank those steps by delay and error rate.
- Build a current access inventory Unify request, certification and entitlement data so reviewers are working from one authoritative view of access instead of reconciling multiple records.
- Automate JML triggers from HR Connect HR status changes and role updates directly to provisioning and deprovisioning workflows across core applications and directory services.
Bottom line: Identity security journeys break down where lifecycle events still require manual handling across multiple systems.
Glossary terms: Lifecycle Automation, Access Certification, Joiner Mover Leaver, Single source of truth
Explore further
View Full Forum → | NHI Foundation Course → | Our Services → | Read the full analysis →
This topic was modified 17 hours ago by NHI Mgmt Group
25/06/2026 3:34 pm
Lifecycle automation is the real maturity boundary in identity security. An identity programme can look complete on paper while still depending on manual joiner, mover and leaver handling behind the scenes. That is where delays, errors and access drift accumulate, especially as organisations add more applications and operating units. The practitioner conclusion is simple: maturity is measured by whether lifecycle events execute consistently without human rework.
A question worth separating out:
Q: How should organisations govern access beyond lifecycle automation?
A: They should separate workflow execution from governance proof. Lifecycle automation can provision or revoke access, but governance must certify that access is still appropriate, enforce separation of duties, and preserve audit evidence. The practical test is whether the organisation can prove who approved access, what changed, and whether the change actually took effect.
👉 Read our full editorial: Identity security journeys still hinge on lifecycle automation