Identity Lifecycle Management

Identity Lifecycle Management (ILM) governs how digital identities are created, maintained, and ultimately removed across an organisation’s technology ecosystem. It is the operational foundation of IGA — without effective lifecycle management, identity data becomes stale, access accumulates, and compliance gaps emerge.

The lifecycle is often summarised as Joiner / Mover / Leaver (JML), describing the three major identity events that trigger provisioning and deprovisioning actions.

The Joiner / Mover / Leaver Model

Joiner — Identity Creation

When a new employee, contractor, or partner joins the organisation, their digital identity must be created across multiple systems.

Joiner SLA targets:

• Account creation: Within 1 hour of HR record creation (automated)
• Base role assignment: Within 4 hours (rule-based)
• Application-specific access: Within 24 hours (may require approval)
• Full access ready: Before employee’s first day

Mover — Identity Changes

When an employee changes roles, departments, or locations, their access must be updated to reflect their new responsibilities.

Mover complexity: Department transfers are the most complex mover event because they require coordinated revocations AND new grants. The revocation gap (time between old access removed and new access granted) must be minimised.

Leaver — Identity Removal

When an employee leaves the organisation, all access must be promptly and completely removed.

Leaver SLA targets:

• Involuntary termination: Account disabled within 5 minutes (automated)
• Voluntary resignation: Account disabled at end-of-day on departure date
• Access removal: Within 1 hour of account disablement (propagation across all systems)
• Credential rotation: Immediately (especially for privileged accounts)

Lifecycle Automation Architecture

HR System (System of Record)
    │
    │ Employee record changes (hire, transfer, termination)
    ▼
IGA Platform
    │
    ├── Policy Engine: Determine required actions based on role model
    ├── Workflow Engine: Execute provisioning/deprovisioning sequences
    └── Reconciliation: Verify actions completed successfully
        │
        ├── AD / Azure AD (identity store)
        ├── SaaS Apps (SCIM provisioning)
        ├── On-prem Apps (agent-based provisioning)
        ├── PAM System (privileged account lifecycle)
        └── CMDB (update configuration records)

Key Integration Points

Entitlement Lifecycle

Entitlements — the specific permissions assigned to users — also have a lifecycle that must be governed:

Lifecycle Challenges and Solutions

Lifecycle Metrics and KPIs

Key Takeaways

• Identity Lifecycle Management governs the joiner/mover/leaver (JML) process — how digital identities are created, updated, and removed across the enterprise
• The joiner process should be fully automated from HR system trigger through account creation and role assignment, with base access ready before the employee’s first day
• The mover process is the most complex lifecycle event, requiring coordinated revocations and grants — especially during department transfers
• The leaver process is the most critical — automate immediate account disablement for involuntary terminations and ensure complete deprovisioning within 1 hour
• Entitlement lifecycle governs permissions from request through provisioning, active use, review, and revocation — each stage requires specific governance controls
• Lifecycle automation depends on well-integrated systems (HR → IGA → AD → SaaS → target systems) with real-time API integration preferred over batch files