Join, Move, Leave is the identity lifecycle model for onboarding, role change, and offboarding. It captures the three moments when access should be created, adjusted, or removed. Mature programs use these events to keep privileges aligned with job function, reduce lingering access, and prevent persistence after a user leaves.
What Join, Move, Leave Means in Practice
Join, Move, Leave is a simple lifecycle model for access governance, but its value is that it turns identity administration into three distinct control moments. “Join” creates access at entry, “Move” adjusts it when a person changes role, and “Leave” removes it when they depart. The model is widely used because each event is a natural checkpoint for entitlement accuracy.
For practitioners, the model is less about labels and more about timing and ownership. It is a way to align access decisions with employment status, role changes, and exits so that access does not drift away from the actual job function.
Why the Lifecycle Model Matters
Join, Move, Leave matters because most access risk comes from stale or mismatched privileges rather than from the initial grant alone. A user can be correctly provisioned on day one and still become over-entitled later if changes are not reflected promptly. The model creates a governance rhythm that keeps access tied to current need.
It also helps separate provisioning from entitlement review. Join is the onboarding event, Move is the recalibration event, and Leave is the revocation event. That distinction matters because each step has different failure modes and different operational owners.
Common Failure Modes
The model breaks down when organisations treat lifecycle events as administrative paperwork rather than access-control triggers. Delayed updates after a role change can leave a person with both old and new privileges, while poor exit handling can leave active accounts, tokens, or shared access paths in place after departure.
Another common failure is partial lifecycle coverage. Many programmes do a reasonable job at Join but are weaker at Move and Leave, which is where privilege accumulation and lingering access usually appear. The result is not just excess access, but uncertainty about who should still be able to do what.
Where Join, Move, Leave Fits in Identity Governance
Join, Move, Leave is a governance model because it links identity state to business events. It sits underneath provisioning, deprovisioning, recertification, and role-based access design, and it gives those processes a shared operational logic. Without it, access reviews tend to become reactive clean-up instead of lifecycle control.
The model also works best when joined to authoritative sources for employment or role status. That reduces the chance that provisioning decisions lag behind organisational change, especially in environments where access changes are frequent or time-sensitive.
Risk and Threat Considerations
Join, Move, Leave creates a concentrated security risk if any of the three lifecycle moments is slow, incomplete, or inconsistent. Stale privileges after a move or leave can preserve access paths that no longer match business need, which is exactly the kind of condition attackers and insiders can exploit for persistence or unauthorized activity.
Failure mechanism: access is not revoked, reduced, or revalidated when the person’s status changes, so old entitlements survive beyond their legitimate use window.
Impact: organisations can end up with excessive privilege, orphaned access, lingering sessions or tokens, and a larger blast radius if the account is misused or compromised.
Standards & Framework Alignment
This section maps relevant standards and security frameworks to the operational risks and controls described in this guidance.
NIST SP 800-53 Rev 5 sets the technical controls, while ISO/IEC 27001:2022 defines the regulatory obligations.
| Framework | Control / Reference | Relevance |
|---|---|---|
| NIST SP 800-53 Rev 5 | AC-2 — Account Management | Join, Move, Leave is an account lifecycle model for creating, changing, and removing access. |
| AC-6 — Least Privilege | Role changes can leave access above job need, making privilege minimisation central to this term. | |
| IA-5 — Authenticator Management | Leaving employment or changing role often requires credential and authenticator reset or revocation. | |
| Recommendation — Map lifecycle events to AC-2 so account creation, modification, and disablement follow current business need. Use AC-6 to remove unnecessary privileges whenever a role or responsibility changes. Apply IA-5 to retire, rotate, or invalidate authenticators when lifecycle events change access. | ||
| ISO/IEC 27001:2022 | A.5.16 — Identity management | The term is fundamentally about managing identities across join, move, and leave events. |
| A.5.18 — Access rights | Join, Move, Leave directly governs how access rights are granted, adjusted, and removed. | |
| Recommendation — Define identity lifecycle ownership and procedures so access changes track personnel status. Review and revoke access rights promptly whenever a user joins, changes role, or leaves. | ||
Practitioner Guidance
Governance implication: treat Join, Move, Leave as a lifecycle control that needs explicit ownership across HR, IAM, and application teams, not as a one-time provisioning workflow. The practical question is whether each change event reliably triggers the right access decision at the right time.
Practitioner takeaway: the model only works when join, move, and leave are all enforced with the same seriousness, because weak offboarding or slow role adjustment can undermine an otherwise strong access programme.
Related resources from NHI Mgmt Group
- What happens when IAM governance does not cover join, move, and leave events consistently?
- Why does SAML reduce operational risk when employees join, move teams, or leave an organisation?
- How should security teams govern third-party workers who join and leave quickly?
- Why does hybrid domain join matter for organisations that cannot move fully to the cloud yet?
Deepen Your Knowledge
Free weekly newsletter
Subscribe to the NHI & AI Identity Journal
The latest on NHI and Agentic AI security – articles, research, breaches, news and events every week.
Bonus 33% off our NHI Course when you subscribe.
Reviewed and updated by the NHIMG editorial team on October 31, 2026.
NHI Mgmt Group — the #1 independent authority on Non-Human Identity, IAM, and Agentic AI security. nhimg.org