Key Takeaways
Identity lifecycle management is the discipline of creating, updating, and removing digital identities and their entitlements in sync with workforce and resource changes, so access reflects current role rather than historical accident.
The joiner–mover–leaver (JML) framework is the operational shorthand: provision on hire (joiner), adjust on transfer (mover), revoke on exit (leaver).
Manual provisioning tickets were manageable in smaller, more stable environments. They fail when every department spins up integrations, contractors rotate quarterly, and orphaned accounts outlive the projects that created them.
This article defines identity lifecycle management, explains JML, walks through joiner, mover, and leaver stages, covers non-human lifecycle, and lists best practices. For the full IGA program context, see Identity Governance & Administration (IGA): The Complete Guide.
- Identity lifecycle management ties access changes to authoritative identity events (HR, contractor management, workload retirement).
- The joiner–mover–leaver model covers provision, role change, and deprovision as the minimum viable lifecycle.
- Leaver automation is often prioritized because terminated users with active entitlements create immediate security and audit risk.
- Identity management lifecycle policies must include machine and agent identities, not only employees.
- Lifecycle automation pairs with access certification for standing access reviews between HR events.
What is identity lifecycle management?
Identity lifecycle management is the end-to-end process of issuing, modifying, and retiring digital identities and entitlements from creation through decommission, aligned to authoritative source systems such as HR, contractor databases, and workload catalogs.
Lifecycle sits inside identity governance and administration (IGA). Governance defines policy; lifecycle executes policy when identity state changes.
Without lifecycle automation:
- Joiners wait days for standard access while tickets queue
- Movers retain old department entitlements after transfer
- Leavers keep VPN, SaaS, and admin roles after termination
NIST SP 800-53 Rev. 5 account management (AC-2) expects timely disablement of inactive accounts. Lifecycle is how enterprises operationalize that control at scale.
Decision rule: Treat HR (or contractor system) status as the authoritative trigger for human identity lifecycle. Ad hoc IT tickets are the exception path.
The joiner–mover–leaver (JML) framework
JML maps identity events to access actions:
| Stage | Trigger | Access action |
|---|---|---|
| Joiner | New hire, contractor start, partner onboarding | Create identity, assign birthright roles, route additional requests |
| Mover | Transfer, promotion, department change, role change | Add new scope, remove obsolete scope, re-certify sensitive access |
| Leaver | Termination, contract end, leave of absence (policy-dependent) | Disable account, revoke entitlements, retain audit trail |
JML is not only an HR framework. The same pattern can apply to machine identities when workloads deploy (joiner), scale or change scope (mover), or retire (leaver).
One measure of identity management lifecycle maturity is automation coverage: what percentage of JML events execute without manual intervention?
Joiner: provisioning new identities
Joiner workflows create identities and grant baseline access when someone enters the organization or a new engagement starts.
Effective joiner automation includes:
- Identity creation in directory services (Entra ID, Active Directory, Okta, etc.)
- Birthright access via role-based templates tied to department, location, or job code
- Request catalog for non-standard entitlements requiring approval
- SoD checks at grant time to block toxic combinations before they exist
- Welcome and MFA enrollment coordinated with IAM onboarding
Joiner failures create security debt on day one: shared credentials, excessive default groups, or shadow admin grants "to unblock" the employee.
Decision rule: Standard roles should provision automatically. Exceptions require approval with named business justification.
Mover: managing role and access changes
Mover workflows adjust entitlements when identity attributes change without a full exit.
Movers are where entitlement sprawl accelerates. Employees accumulate access across roles; transfers add new scope without removing old scope.
Mover automation should:
- Detect attribute changes from HR feeds (job code, department, manager, location)
- Apply delta policies: grant new birthright roles, trigger removal of prior department roles
- Flag sensitive access for re-certification when risk profile changes
- Notify managers when movers retain cross-department privileged roles
Mover events often require human judgment for project-specific access. The governance platform should distinguish birthright changes (automated) from discretionary entitlements (reviewed).
Pair mover policy with periodic access reviews to evaluate entitlements that automation cannot infer from HR data alone.
Leaver: deprovisioning and offboarding
Leaver workflows disable identities and revoke entitlements when employment or engagement ends.
Leaver is often treated as the highest-priority lifecycle stage. Orphaned accounts from incomplete offboarding are a recurring audit finding and security risk.
Leaver automation should cover:
- Account disable in directory services (immediate or scheduled per policy)
- Entitlement revocation across SaaS, cloud IAM, VPN, and on-prem apps via connectors
- Mailbox and data handling per legal/HR policy (often coordinated outside IGA)
- Privileged access removal including PAM vault entries and break-glass accounts
- Audit record of disable timestamp and systems processed
Decision rule: Define a rapid deprovisioning SLA for involuntary terminations and a scheduled process for voluntary departures. Partial leaver processing can create false confidence by disabling the primary account while leaving other access active.
Identity lifecycle management for non-human identities
Human JML dominates training material. Machine and agent populations now require the same rigor. Example lifecycle triggers include:
| Identity type | Joiner trigger | Mover trigger | Leaver trigger |
|---|---|---|---|
| Service account | Workload deploy | Role/scope change | Workload decommission |
| CI/CD bot | Pipeline creation | Permission update | Pipeline delete |
| SaaS integration | Vendor onboarding | Scope expansion | Contract termination |
| AI agent | Agent registration | Task context change | Agent retirement |
Non-human identity (NHI) lifecycle often lacks HR triggers. Authoritative sources may include asset catalogs, CI/CD systems, and integration registries.
Decision rule: Assign a human owner to every non-human identity before production credentials are issued. Include owner attestation in access certification for standing machine access.
For agent-specific lifecycle, see Agentic AI Identity: Securing AI Agents (Complete Guide).
Identity lifecycle management best practices
- 1.Prioritize leaver automation. Incomplete offboarding creates immediate security and audit risk.
- 2.Use authoritative HR (or contractor) feeds. Manual lifecycle tickets become difficult to scale and can drift from authoritative data.
- 3.Separate birthright from discretionary access. Automate role templates; approve exceptions.
- 4.Apply mover deltas, not only additive grants. Remove obsolete department entitlements on transfer.
- 5.Extend lifecycle to machines and agents. If provisioning is automated via Terraform, deprovisioning must be equally automated.
- 6.Log every lifecycle action for audit. Joiner, mover, and leaver records can support SOX, HIPAA, and internal access-control evidence.
- 7.Pair lifecycle with certification. Lifecycle handles event-driven changes; access certification handles standing entitlements between events.
- 8.Test leaver paths regularly. Run synthetic termination drills against the highest-risk connected applications.
How many systems still require a manual ticket when someone leaves?
How NewCore extends the identity lifecycle
Traditional JML follows the employee lifecycle. Machines and AI agents do not share the same HR clock, yet their accounts and entitlements still need clear creation, change, ownership, and retirement events.
NewCore brings human, machine, and agent identities into one lifecycle model. Lifecycle governance coordinates provisioning, right-sizing, attestation, and revocation across directories, SaaS applications, and agent connections.
Identity Explorer discovers and maps identities, accounts, entitlements, owners, and access paths, helping teams find access that remains after a user, workload, integration, or agent becomes inactive.
For AI agents, each identity has its own lifecycle, policy, and revocation path. Offboarding can operate at the speed agents do, rather than waiting for a manual ticket.
NewCore's position is simple: offboarding should be automatic, not aspirational.
FAQ
What is identity lifecycle management?
Identity lifecycle management is the process of creating, updating, and removing digital identities and entitlements in sync with workforce and resource changes throughout the identity's useful life.
What is joiner-mover-leaver (JML)?
JML is a framework mapping joiner (hire/onboard), mover (transfer/role change), and leaver (termination/offboard) events to provisioning, adjustment, and deprovisioning actions.
What is the identity management lifecycle?
The identity management lifecycle is the full span of identity states from creation through active use, role changes, and decommission, including governance and audit at each transition.
Why is leaver automation often prioritized?
Terminated users with active entitlements create orphaned access, audit findings, and potential breach paths. Rapid, complete deprovisioning reduces the period in which former users or abandoned accounts retain access.
Does lifecycle management apply to non-human identities?
Yes. Service accounts, integrations, and agents need joiner-mover-leaver equivalents tied to workload and contract events, with human owners accountable for attestation.
