Notifications
Clear all
Topic starter
23/06/2026 9:19 pm
TL;DR: Automating employee onboarding and offboarding can reduce manual effort, speed access changes, and help meet legal and regulatory requirements, but the underlying governance problem is still consistency, visibility, and timely revocation across SaaS access and SSO flows. Manual lifecycle handling remains error-prone in organisations with hundreds of employees, and Zluri’s walkthrough shows why process automation matters more than workflow convenience.
NHIMG editorial — based on content published by Zluri: Lifecycle Management Instant Onboarding and Offboarding
Questions worth separating out
Q: How should security teams automate employee onboarding without losing access governance?
A: Security teams should automate onboarding by tying joiner events to role-based access sets, named approvers, and reusable workflows.
Q: Why does offboarding remain a risk even when access revocation is automated?
A: Offboarding remains risky when revocation does not reach every connected system.
Q: How do organisations know whether lifecycle automation is actually working?
A: They know it is working when provisioning and revocation are consistent, timely, and auditable across the full application estate.
Practitioner guidance
- Map joiner and leaver workflows to policy-owned access sets Define the exact SaaS apps, groups, licenses, and SSO entitlements each role should receive or lose, then compare automated workflow outputs against that policy set on a regular basis.
- Test offboarding beyond the primary directory account Validate that a leaver event revokes access in downstream applications, licenses, and shared resources, not only in the core identity source.
- Use playbooks as audited lifecycle controls Treat reusable workflow templates as governance artefacts, with named owners, approval paths, and exception handling that can be reviewed during access certification.
What's in the full article
Zluri's full blog covers the operational detail this post intentionally leaves for the source:
- Step-by-step onboarding workflow setup, including how the workflow module and playbooks are used in practice.
- Detailed offboarding actions for revoking devices, apps, systems, licenses, and SSO access.
- Guidance on adding custom rules, triggers, and scheduled workflow execution for repeatable lifecycle handling.
- Examples of how teams can save reusable playbooks for recurring employee transitions.
👉 Read Zluri's guide to automated employee onboarding and offboarding workflows →
Lifecycle automation for employees: what IAM teams still miss?
Explore further
25/06/2026 2:33 am
Lifecycle automation is only as strong as the revocation boundary it actually reaches. This article treats offboarding as an instant administrative action, but identity risk appears when one workflow does not fully touch licenses, SSO, and downstream SaaS entitlements. The field-wide lesson is that lifecycle governance fails at the handoff between systems, not at the point of intent. Practitioners should test the full revocation chain, not just the directory event.
A few things that frame the scale:
- 91.6% of secrets remain valid five days after the targeted organisation is notified, showing a critical gap in remediation procedures, according to Ultimate Guide to NHIs.
- Only 5.7% of organisations have full visibility into their service accounts, which shows how often identity programmes still lack reliable inventory and control coverage.
A question worth separating out:
Q: Who should own onboarding and offboarding failures when they happen?
A: Ownership should sit with the identity governance function, but each application owner must be accountable for downstream cleanup in their system. If a workflow fails, the issue is not only technical. It is also an operating model problem that needs clear escalation paths and control ownership.
👉 Read our full editorial: Automated employee onboarding and offboarding still leaves IAM gaps
