Topic starter
23/03/2026 2:07 pm
TL;DR: Identity lifecycle management is breaking down where joiner, mover, and leaver processes remain siloed, leaving organisations with access sprawl, incomplete offboarding, and weak audit evidence, according to Oleria Security. Unified automation is now the difference between defensible governance and manual lifecycle drift.
Editorial analysis by NHI Mgmt Group, based on content published by Oleria Security: “Identity lifecycle management: the complete guide to joiner-mover-leaver automation”.
By the numbers:
- Over 95% of multi-cloud permissions remain unused, increasing risk without providing any business benefit.
- Only 42% of enterprises have deployed standard IGA tools, well below firewalls, email security and SIEM tools.
- Firewalls are deployed in 83% of enterprises, according to the article’s comparison of common security controls.
Key questions
Q: What breaks when joiner-mover-leaver workflows are mostly manual?
A: Manual workflows create delay, inconsistency, and missed revocations.
Q: Why do unused permissions become a security risk in JML programmes?
A: Unused permissions still expand the attack surface and create standing access that attackers can abuse if an account is compromised.
Q: How do organisations know offboarding is actually complete?
A: They know offboarding is complete when the revocation checklist is built from current entitlements, not from an old spreadsheet or onboarding record.
Practitioner guidance
- Consolidate identity state into one lifecycle view Map HR, identity provider, SaaS, cloud and application records into a single workflow state so joiner, mover and leaver events reference the same source of truth.
- Automate mover cleanup for legacy permissions Remove previous role entitlements when a person changes position, instead of layering new access on top of old access that may never be used again.
- Verify leaver revocation across downstream systems Check shared drives, email groups, VPNs, third-party apps and machine tokens after termination so hidden access does not survive primary deprovisioning.
Bottom line: Siloed JML creates access drift because joiner, mover and leaver controls stop sharing one entitlement state.
Explore further
View Full Forum → | NHI Foundation Course → | Our Services → | Read the full analysis →
This topic was modified 6 days ago by NHI Mgmt Group
06/10/2026 7:19 pm
Identity lifecycle governance fails when joiner, mover and leaver are managed as separate administrative events rather than one control system. The article’s core problem is not lack of policy, but broken continuity between provisioning, change and deprovisioning. Once those stages are split across tools and teams, audit evidence fragments and access decisions lose context. The practitioner conclusion is simple: lifecycle governance has to be treated as a single state model, not three disconnected queues.
A question worth separating out:
Q: What is the difference between workflow automation and lifecycle governance?
A: Workflow automation moves tasks between systems, while lifecycle governance decides whether the right identity state changes should happen at all. A platform can automate a process without proving that the process is accurate, auditable, or aligned to current business ownership.
👉 Read our full editorial: Identity lifecycle management is failing where JML stays siloed