Topic starter
06/11/2026 6:39 pm
TL;DR: Only 8% of companies have fully automated provisioning while 70% still rely on manual joiner-mover-leaver operations, according to READI research, leaving legacy apps, cloud terminations and non-account workflows exposed to slow handoffs and hidden exceptions. Manual orchestration turns identity governance into a partial control that misses the operational state practitioners need to manage.
Editorial analysis by NHI Mgmt Group, based on content published by READI: “Your Identity Processes – Connect More!”.
Key questions
Q: What breaks when joiner-mover-leaver workflows are mostly manual?
A: Manual workflows create delay, inconsistency, and missed revocations.
Q: Why do delayed offboarding processes create security risk?
A: Delayed offboarding creates security risk because access can remain active after the business relationship ends.
Q: How do manual connector gaps affect identity governance?
A: Manual connector gaps force identity governance teams to manage accounts, entitlements and lifecycle events outside automated provisioning and reconciliation.
Practitioner guidance
- Map every manual handoff in lifecycle workflows Identify where provisioning, deprovisioning or adjacent onboarding tasks leave the identity platform and become tickets, emails or local fulfilment steps.
- Measure termination by residual access time Track how long ex-employees or moved users retain access in each downstream system after the triggering HR event, especially cloud apps without direct enforcement.
- Extend governance to non-account onboarding tasks Bring device, badge and phone readiness into the same operational view so exceptions are visible before the first day of work.
Bottom line: Manual lifecycle workflows create hidden control gaps because governance stops at the request and not at the final state.
Explore further
View Full Forum → | NHI Foundation Course → | Our Services → | Read the full analysis →
06/11/2026 6:41 pm
Joiner-mover-leaver automation is only as strong as the least automated downstream step. READI's framing shows a common governance illusion: the IGA layer can look complete while service desk queues, legacy interfaces and operational tasks still require manual fulfilment. That means the programme measures workflow initiation more reliably than workflow completion. Practitioners should judge lifecycle maturity by the slowest handoff, not the best-integrated system.
A question worth separating out:
Q: What should teams do when onboarding tasks fall outside IAM?
A: Teams should route those tasks to the owning operational process, with clear control ownership, evidence capture and an exception path back into IAM where access is involved. For example, device setup, software installation and hardware fulfilment can sit in onboarding workflows, while account creation, MFA enrolment and privileged access requests remain under IAM. That separation avoids confusing identity administration with general IT fulfilment.
👉 Read our full editorial: Manual joiner-mover-leaver workflows leave identity gaps open