The Identity Lifecycle

Every digital identity follows a predictable lifecycle from creation to removal. The joiner-mover-leaver (JML) model is the industry-standard framework for managing identity lifecycles in enterprise IAM. Mastering JML is essential for any IAM professional because it governs how identities flow through the organisation — and the security risks at each stage.

The JML model is deceptively simple in concept but complex in execution. Large enterprises process thousands of JML events per month across hundreds of connected systems, each with its own identity store, provisioning method, and deprovisioning capability.

The JML Model

    graph LR
    J[Joiner<br/>Create Identity] --> M[Mover<br/>Modify Access]
    M --> L[Leaver<br/>Remove Access]
    L -.->|Rehire| J
    
    J -->|Failure mode| JO[Orphan account<br/>if never started]
    M -->|Failure mode| MO[Privilege creep<br/>if not recertified]
    L -->|Failure mode| LO[Dormant account<br/>if not removed]
  

Joiner — Onboarding

When a person joins an organisation, IAM systems must create a digital identity and provision the necessary access. The joiner process is the most visible IAM function and directly impacts employee productivity.

Step-by-step joiner workflow:

1. Trigger — HR system (Workday, SAP SuccessFactors, BambooHR) creates employee record with a start date. An identity event is published to the IAM platform
2. Identity creation — IAM creates identity records in authoritative directories:
   • Active Directory user object with UPN, department, location attributes
   • Cloud IdP (Azure AD / Okta) user with group assignments
   • Email mailbox (Exchange Online / Google Workspace)
3. Entitlement assignment — Based on the user’s role, department, and location, IAM assigns a baseline set of entitlements:
   • Universal access — Email, VPN, intranet, corporate SSO
   • Role-based access — Applications required for the user’s job function
   • Discretionary access — Additional applications requested by the manager
4. Account provisioning — IAM pushes account creation to target systems via:
   • SCIM (modern): REST API calls to create user accounts
   • PowerShell / LDAP (legacy): Direct directory manipulation
   • Custom connectors: JDBC-based adapters for legacy applications
5. Credential issuance — Initial credentials are delivered to the user:
   • Temporary password (must change on first login)
   • Hardware token (FIDO2 key, smart card) for privileged roles
   • Mobile authenticator registration for MFA
6. Notification — Stakeholders are informed:
   • Manager: Welcome email with access summary
   • IT: Checklist for hardware and network access
   • Security: Record of identity creation for audit
   • Facilities: Badge access if applicable

Mover — Role Changes

When a user changes roles, departments, or employment status, their access must evolve. The mover scenario accounts for the majority of identity changes in a typical enterprise — far more people change roles than join or leave.

Mover scenarios in detail:

The Mover Challenge: Unlike joiner (which creates from scratch), mover requires precise changes to existing entitlements. The key challenge is ensuring that old access is removed while new access is added — removing only what should be removed and adding only what should be added.

Leaver — Offboarding

When a user leaves the organisation, their digital identities must be deprovisioned promptly and completely. Leaver processing is the single most important IAM control for security — delayed or incomplete deprovisioning is responsible for countless insider threat incidents.

Deprovisioning actions by urgency:

Lifecycle Automation — The Mature Approach

Mature IAM programs automate the JML lifecycle end-to-end:

Lifecycle Challenges — Real-World Scenarios

Common challenges organisations face — and how to address them:

Key Takeaways

• The joiner-mover-leaver (JML) model governs identity lifecycle management and is the operational foundation of IAM
• Joiner processes must start with least privilege — excessive initial access that is never reviewed is the most common failure
• Mover scenarios (role changes, transfers, promotions) require automatic recalculation of entitlements — never let permissions accumulate
• Leaver deprovisioning must be immediate for Tier 1 actions (account disable, credential revocation) and automated for all tiers
• HR system integration (HRIS → IAM) is the non-negotiable foundation of lifecycle automation
• Periodic reconciliation between actual and approved access catches what automation misses — run it quarterly at minimum
• Service and workload identities follow their own lifecycle patterns and require dedicated management processes