Notifications
Clear all
Topic starter
12/06/2026 1:13 am
TL;DR: Manual onboarding, role changes, and offboarding create avoidable access gaps because teams must grant, modify, and revoke SaaS permissions across the user lifecycle, according to Zluri. The governance issue is not speed alone, but whether identity lifecycle processes can keep pace with employee movement without leaving standing access behind.
NHIMG editorial — based on content published by Zluri: Lifecycle Management Reasons Why You Need a Lifecycle Management Platform
Questions worth separating out
Q: How should teams manage user onboarding and offboarding more reliably?
A: Teams should automate joiner-mover-leaver workflows so access follows role and employment status instead of ticket queues.
Q: Why do lifecycle management gaps create security risk?
A: Lifecycle gaps create risk because access often remains active after it is no longer needed.
Q: What do security teams get wrong about access requests?
A: Teams often treat self-service access as a user-experience feature instead of a governance control point.
Practitioner guidance
- Map onboarding to role-specific access sets Define standard access bundles for each role, department, and location so provisioning does not depend on ad hoc ticket handling.
- Test mover processes for entitlement removal Run role-change simulations and confirm that obsolete permissions are removed, not only new ones added.
- Audit offboarding for complete revocation Inventory every system, SaaS app, and delegated access path that must be closed when someone leaves.
What's in the full article
Zluri's full blog post covers the operational detail this post intentionally leaves for the source:
- Step-by-step onboarding workflow setup for provisioning new users across SaaS applications.
- Role-change handling details tied to HRMS updates and centralized access tracking.
- Offboarding workflow steps for deprovisioning departing users and removing app access.
- Employee app store request flow and approval handling for self-service access.
User lifecycle management: what IAM teams need to fix now?
Explore further
12/06/2026 11:01 am
Lifecycle governance fails when access is treated as a one-time event. The article shows the classic joiner-mover-leaver problem: access is granted at hire, adjusted during role changes, and revoked on exit. That sounds procedural, but the underlying governance failure is persistence. Once access is issued, organisations often assume later cleanup will happen cleanly, yet manual workflows and ticket-based handling make that assumption unreliable. The implication is that lifecycle governance must be managed as an ongoing control state, not an administrative task.
A few things that frame the scale:
- 91.6% of secrets remain valid five days after the targeted organisation is notified, showing a critical gap in remediation procedures, according to Ultimate Guide to NHIs.
- Only 20% have formal processes for offboarding and revoking API keys, and even fewer have procedures for rotating them.
A question worth separating out:
Q: Who is accountable when access is not revoked on time?
A: Accountability sits with the identity governance process owner, the application owner, and the HR or IT workflow that failed to trigger or complete revocation. For regulated environments, the question is not just who clicked revoke, but whether the organisation can prove complete deprovisioning across all relevant systems.
👉 Read our full editorial: Lifecycle management platforms expose the access governance gap
