Topic starter
15/12/2025 4:00 pm
TL;DR: Joiner, mover, and leaver processes determine whether identities receive the right access at the right time, and Delinea argues that manual handoffs, privilege drift, and delayed deprovisioning create avoidable security and compliance risk. The operational lesson is that lifecycle governance is an access control problem, not an administrative afterthought.
Editorial analysis by NHI Mgmt Group, based on content published by Delinea: “Managing the identity lifecycle of Joiners, Movers, and Leavers (JML) is the backbone to strong identity security”.
Key questions
Q: What breaks when joiner mover leaver processes are handled manually at scale?
A: Manual joiner mover leaver handling creates inconsistent access, delayed productivity, and incomplete removal of entitlements when people change roles or leave.
Q: Why do poor leaver processes create both security and compliance risk?
A: Because access that should end with the relationship continues to exist.
Q: How should organisations handle access when employees change roles internally?
A: Organisations should link internal role changes to access changes in the same workflow.
Practitioner guidance
- Define lifecycle ownership for every identity class Assign explicit ownership for employees, contractors and third parties so joiner, mover and leaver changes do not depend on informal handoffs between HR, IT and application teams.
- Automate leaver deprovisioning across connected systems Trigger account disablement, token revocation and application-level removal from the HR or source-of-truth event, not from a manual ticket that can lag behind the departure date.
- Treat mover events as removal plus addition Build workflows that revoke obsolete entitlements when role, department or project context changes, instead of only appending new access to the existing profile.
Bottom line: JML governance determines whether identities are provisioned, adjusted and removed in line with real business state.
Explore further
View Full Forum → | NHI Foundation Course → | Our Services → | Read the full analysis →
This topic was modified 10 months ago 2 times by Abdelrahman
This topic was modified 2 days ago by NHI Mgmt Group
11/10/2026 4:17 am
JML is not an HR workflow, it is the access control system that identity security rests on. When joiner, mover and leaver events are not connected to authoritative identity enforcement, access decisions become a patchwork of manual exceptions. That breaks least privilege in practice, because entitlement accuracy depends on lifecycle state, not on static role design. The practitioner conclusion is simple: lifecycle governance is the control plane for all identity programmes.
A few things that frame the scale:
- Around 59% of companies report experiencing a data breach related to poorly managed offboarding processes.
A question worth separating out:
Q: When is it safe to leave contractor or vendor access in place?
A: Only when the identity still has an active business need, a current sponsor and a defined end date. If any of those conditions are missing, the account should be treated as stale access and removed. Preserving unused third-party access for convenience is a common governance failure.
👉 Read our full editorial: JML identity lifecycle management is still the backbone of IAM