Topic starter
12/06/2026 9:33 pm
TL;DR: Most organisations manage only onboarding and offboarding, while roughly 30 of the 32-plus access-impacting events in a typical five-year employee journey are handled through tickets and memory, according to Zluri. That gap turns promotions, transfers, temporary elevations, and project work into privilege creep and audit exposure.
Editorial analysis by NHI Mgmt Group, based on content published by Zluri: “User Lifecycle Management: The 30 Events Nobody Manages And How to Automate Them”.
By the numbers:
- Over a typical 5-year tenure, an employee experiences 32+ access-impacting events, according to Zluri.
- The remaining 30 events represent 94% of the lifecycle and are handled reactively, according to Zluri.
- A typical 100-person company faces roughly 650 access-impacting events annually, according to Zluri.
Key questions
Q: What breaks when identity lifecycle management only automates onboarding?
A: Offboarding and role changes become the weak point, which leaves stale access, orphaned accounts, and entitlement drift in place after the business has moved on.
Q: When does manual lifecycle management become a security risk?
A: Manual lifecycle management becomes a risk as soon as entitlement changes depend on tickets, email, or human memory.
Q: What are the signs that least privilege is failing in an IAM programme?
A: Common signs include users keeping access after role changes, service accounts with more privileges than they use, repeated audit exceptions, and manual access reviews that cannot keep up with entitlement growth.
Practitioner guidance
- Automate HR-triggered access changes Use job title, department, manager, team, location, status, and contract-date changes as the trigger for access workflows rather than tickets or Slack requests.
- Model every role transition as an access delta For promotions, transfers, and team moves, calculate what must be added, removed, and re-scoped so old access does not stack with new access.
- Set expiry on temporary access at issuance Grant on-call, project, and incident elevation with a hard end time and automated revocation tied to the original business justification.
Bottom line: The article’s central warning is that lifecycle governance breaks down when organisations stop at onboarding and offboarding.
Explore further
View Full Forum → | NHI Foundation Course → | Our Services → | Read the full analysis →
This topic was modified 6 days ago by NHI Mgmt Group
12/06/2026 11:42 pm
Lifecycle governance fails when access is treated as a start-and-stop event. The article shows that most organisations still behave as though onboarding and offboarding are the only meaningful control points. That assumption leaves the 30-plus in-between events outside governance, where privilege creep becomes normal rather than exceptional. For human IAM, the real control problem is not provisioning at entry. It is continuous entitlement re-alignment during the employment lifecycle.
A question worth separating out:
Q: How should organisations handle access when employees change roles internally?
A: Organisations should link internal role changes to access changes in the same workflow. New responsibilities, approvals, and collaboration tools should be updated together so old permissions do not linger. That reduces privilege drift and makes mover processes easier to audit, especially in remote-first teams where informal handoffs are harder to spot.
👉 Read our full editorial: User lifecycle management is failing in the 30-event middle
This post was modified 6 days ago by NHI Mgmt Group