What Is the Joiners Movers Leavers (JML) Process?
Joiner-Mover-Leaver (JML) is an identity lifecycle management framework that automates how user access rights, accounts, and permissions are provisioned, updated, and revoked based on an employee's status.
The JML process typically involves coordination between human resources (HR), IT, security, and application teams. HR systems provide employee lifecycle events, while IAM platforms and other identity management tools detect changes to non-human identities. These events trigger account provisioning, permission updates, credential rotation, and deprovisioning workflows.
The three phases of JML:
Joiner (Onboarding): Triggered when a new hire or contractor joins. It auto-provisions baseline "birthright" access and role-based permissions so the user is productive on day one.
Mover (Internal Transfer): Triggered when an employee changes roles, gets promoted, or switches departments. It grants new permissions while revoking old ones to prevent "access creep" and security policy violations.
Leaver (Offboarding): Triggered when an employee departs the organization. It immediately disables accounts and revokes all application, VPN, and physical access to stop insider threats.
How AI and automation improve JML management:
Automated identity discovery and access mapping: Uncovers accounts, permissions, and access paths to support accurate lifecycle management.
AI-driven role mining and access recommendations: Identifies access patterns to build business-aligned roles, subject to owner validation.
Peer-group analytics and role intelligence: Flags unusual entitlements and prioritizes sensitive access for contextual review.
Intelligent least-privilege provisioning for new joiners: Automates approved access provisioning while limiting unnecessary permissions.
Dynamic entitlement adjustments for movers: Reassesses access during role changes and applies approved updates to reduce privilege creep.
Automated access revocation and risk remediation for leavers: Removes access, identifies overlooked accounts, and escalates unsuccessful revocations.
Automated access reviews and compliance reporting: Highlights access needing review and collects traceable records to support audits.
This is part of a series of articles about identity and access management
Why Is the Joiner Mover Leaver Process Important for Identity Security?
The joiner mover leaver (JML) process keeps access aligned with employees’ responsibilities throughout their time at an organization. By connecting employment changes to identity and access management (IAM) workflows, organizations can reduce unnecessary permissions, prevent unauthorized access, and maintain evidence of effective access controls.
Enforcing least-privilege access: JML workflows grant access based on job requirements, adjust permissions when responsibilities change, and revoke access when employees leave.
Preventing privilege accumulation: Reviewing existing permissions during role changes helps remove outdated access rather than simply adding new privileges, limiting risks from compromised accounts and misuse.
Reducing orphaned accounts: Structured offboarding deactivates accounts, revokes sessions, and removes application access. Regular reconciliation helps identify accounts missed by automated deprovisioning.
Supporting compliance and audits: Documented approvals, access reviews, and deprovisioning records help demonstrate access controls. Related lifecycle controls should also track ownership and permissions for non-human identities accessing sensitive systems.
Defining the Three Stages of the JML Lifecycle
Joiners: Employee Onboarding and Initial Access Provisioning
The joiner stage begins when a new employee or contractor enters the organization. An event in the HR system triggers identity creation and account provisioning across required applications, directories, and IT services. Identity and access management (IAM) workflows assign baseline access based on the individual's department, job role, location, and employment type.
Automated provisioning helps ensure new joiners receive the permissions they need without unnecessary administrative privileges. Role-based access control (RBAC), predefined access policies, and approval workflows determine which resources each user can access. Organizations should also configure authentication requirements, enroll users in multi-factor authentication (MFA), and record provisioning activities for auditing.
How to do it properly:
Use HRIS as the source of truth: Configure the human resources information system (HRIS) to automatically trigger identity creation and provisioning when a verified joiner event occurs, rather than relying on manual IT requests.
Default to zero standing access: Avoid granting broad birthright permissions automatically. Provision access only after verifying the employee's role, responsibilities, and specific resource requirements.
Manage exceptions through approval workflows: Treat access beyond verified role requirements as an exception that requires documented justification, appropriate approval, and periodic review.
Movers: Role Changes and Access Rights Adjustments
The mover stage occurs when an employee changes departments, receives a promotion, transfers to another team, or takes on different responsibilities. These changes can require access to new applications, systems, and data. HR updates trigger IAM workflows that reassess existing entitlements and determine which permissions should be added, modified, or removed.
A key objective is preventing privilege accumulation, also known as access creep. Instead of simply granting additional permissions, organizations should revoke access that is no longer required for the employee's new role. Automated access reviews, role-based policies, and approval procedures help enforce least privilege while maintaining records of permission changes.
How to do it properly:
Prevent access debt: Identify and revoke permissions inherited from previous roles. Access debt accumulates when employees receive new entitlements without losing access they no longer need.
Detect separation of duties (SoD) conflicts: Evaluate permission changes for toxic combinations that allow users to perform conflicting activities, such as creating vendors and approving payments.
Validate access changes immediately: Run entitlement comparisons and SoD checks whenever an employee changes roles, rather than relying solely on periodic access reviews that may miss newly introduced risks.
Leavers: Employee Offboarding and Access Revocation
The leaver stage begins when an employee or contractor leaves the organization or their access is otherwise terminated. An HR termination event triggers deprovisioning workflows that disable user accounts, revoke active sessions, invalidate authentication tokens, and remove access to enterprise applications, VPNs, and other protected resources. The timing of these actions should reflect the organization's security policies and the circumstances of the departure.
Effective offboarding must also address accounts and permissions that automated workflows may overlook. Organizations should identify shared credentials, privileged accounts, third-party application access, and any remaining active sessions associated with the departing user. Reconciliation checks help detect incomplete revocations and orphaned accounts, while audit logs provide evidence that access was removed according to policy.
How to do it properly:
Track mean time to deprovision (MTTD): Measure the time between an employee's effective departure and the revocation of their access. Use this metric to identify delays and enforce offboarding service-level targets.
Detect stale accounts through usage telemetry: Analyze authentication logs, application activity, and identity usage patterns to identify accounts that remain active after their owners have departed.
Verify complete access removal: Reconcile HR termination records against identity directories, applications, and privileged accounts. Investigate failed deprovisioning actions and retain evidence of completed revocations to address audit findings.
Common Security Risks and Challenges in JML Management
Joiner, mover, and leaver (JML) management helps ensure identities have appropriate access throughout their lifecycle. Manual processes, incomplete integrations, and inconsistent controls can leave unnecessary permissions or active accounts in place, increasing the risk of unauthorized access.
Manual provisioning and deprovisioning processes: Manual account creation and removal can cause errors, inconsistent permissions, and overlooked accounts. HR-triggered automation helps standardize access changes and maintain audit records.
Excessive access permissions during employee onboarding: Broad permission groups and copied access rights can give new employees unnecessary privileges. Role-based policies, least privilege, and approvals for sensitive access reduce this risk.
Privilege creep following role changes: Employees can accumulate unnecessary permissions when previous access remains after a transfer. Mover workflows should review existing privileges, remove outdated access, and flag sensitive permissions for approval.
Delayed access revocation during offboarding: Communication gaps and incomplete workflows can leave former employees with valid accounts, sessions, or tokens. Automated offboarding should revoke access within defined deadlines and verify completion.
Orphaned accounts and unmanaged identities: Accounts without valid owners or centralized oversight can retain exploitable access. Regular reconciliation, identity discovery, and access certification help identify and remove unnecessary accounts.
Non-human identity and AI agent lifecycle gaps: Service accounts, API keys, and AI agents may retain access after their purpose ends. Track ownership, permissions, and lifecycle status, and automate access removal when services or agents are retired.
Segregation of duties violations following role changes: New permissions can combine with retained access to enable conflicting actions, such as initiating and approving payments. Mover workflows should detect these conflicts across applications and require remediation or documented exceptions.
Related content: Read our article about the causes of identity sprawl and how to prevent it
How AI-Driven Automation Transforms Joiner Mover Leaver Management
Automated Identity Discovery and Access Mapping
Automated identity discovery identifies user accounts, service accounts, and other identities across an organization’s technology environment. Integrations with Microsoft Entra ID, Active Directory, and SaaS applications collect account, group, and permission data. Access mapping connects these identities to the applications, databases, and resources they can reach.
This helps security teams understand permissions assigned through nested groups or inherited roles. AI can analyze these relationships to flag unusual access, potentially duplicate accounts, and unmanaged identities. Together, discovery and mapping provide a clearer foundation for managing access throughout the joiner, mover, and leaver lifecycle.
Why it matters:
Improves visibility into identities and permissions across connected systems.
Helps uncover unmanaged accounts and overlooked access paths.
Supports more accurate provisioning, access changes, and offboarding.
AI-Driven Role Mining and Access Recommendations
Role mining examines existing permissions to identify access patterns among employees with similar responsibilities. AI-driven approaches can consider department, job function, application usage, and previous access decisions. These insights help organizations develop access profiles that reflect actual business needs rather than copying individual permissions.
For example, a system may recommend reporting tools for finance employees while flagging administrative privileges as exceptions. However, common permissions are not necessarily appropriate, because historical access may already include excessive privileges. Access owners should validate AI-generated recommendations against business requirements before incorporating them into role-based access control policies.
Why it matters:
Helps build consistent, business-aligned access profiles.
Identifies permissions that may not belong in standard roles.
Reduces manual role-design work while preserving owner oversight.
Peer-Group Analytics and Role Intelligence
Peer-group analytics compares employees with similar responsibilities to identify expected access patterns and unusual entitlements. Models can examine permissions, departments, job functions, and application usage to support these comparisons.
For example, database administrator privileges may warrant investigation when an employee’s peers typically have read-only reporting access. These differences are review signals, not proof that access is inappropriate or unnecessary. Role intelligence can also prioritize entitlements based on privilege levels, resource sensitivity, and potentially conflicting access combinations. Combined with business context, these insights help reviewers investigate privilege creep and refine access policies.
Why it matters:
Flags access differences that deserve closer investigation.
Prioritizes sensitive permissions and potential segregation of duties conflicts.
Supports ongoing role refinement without treating peer behavior as definitive.
Intelligent Least-Privilege Provisioning for New Joiners
AI-assisted provisioning recommends access for new employees based on their responsibilities and approved organizational policies. Recommendations can draw on role definitions, employee attributes, and relevant usage patterns rather than copying another employee’s permissions.
For example, a developer may need source code repositories and development tools without requiring production administration rights. Policy checks and appropriate approvals determine which recommended permissions can actually be granted. Automated workflows then provision approved access through connected identity and application systems. This approach helps employees become productive sooner while limiting unnecessary privileges from the start.
Why it matters:
Reduces onboarding delays through automated provisioning.
Limits unnecessary access inherited from copied user profiles.
Routes sensitive or nonstandard requests to appropriate approvers.
Dynamic Entitlement Adjustments for Movers
When employees change roles, their existing permissions may no longer match their new responsibilities. AI-assisted analysis can compare current access with approved requirements for the destination role. It can recommend which entitlements to add, modify, or remove while highlighting exceptions that need review.
For example, someone moving from IT support to security operations may need monitoring tools but no longer require help desk administration access. Automated workflows can apply approved changes when reliable HR updates trigger the mover process. Sensitive permissions and temporary access overlaps should remain subject to explicit policies and review.
Why it matters:
Reduces privilege creep by reassessing existing access during role changes.
Helps employees receive the permissions needed for new responsibilities.
Replaces manual access comparisons with policy-driven workflows.
Automated Access Revocation and Risk Remediation for Leavers
Automated offboarding uses termination events to initiate access removal across integrated systems. Depending on system capabilities, workflows can disable accounts, remove permissions, and revoke sessions or tokens. AI-assisted identity analysis can help identify secondary accounts, privileged memberships, and other access paths that standard workflows might miss.
Findings can be prioritized according to resource sensitivity and the level of privilege involved. Verification checks should confirm that revocation actions succeeded and surface failures for investigation. Because integrations and application capabilities vary, unresolved access requires clear ownership and follow-up rather than assumptions of complete removal.
Why it matters:
Shortens the window in which departing employees may retain access.
Helps identify overlooked accounts and residual permissions.
Verifies offboarding outcomes and escalates unsuccessful revocation actions.
Automated Access Reviews and Compliance Reporting
Access reviews verify whether employees still need the permissions assigned to them. AI can support reviewers by highlighting unused entitlements, unusual peer-group differences, and identity risk indicators. These signals help managers and application owners focus attention on access that warrants closer examination. However, infrequent usage alone does not establish that a permission should be removed.
Automation can also collect records of provisioning, approvals, access changes, review decisions, and revocations. These records support audit evidence for relevant controls under frameworks such as SOC 2 and ISO 27001, without independently establishing compliance.
Why it matters:
Focuses reviewer attention on potentially unnecessary or high-risk access.
Reduces manual evidence collection and reporting effort.
Provides traceable records that support audits and accountability.
Best Practices for Managing the Joiner Mover Leaver Process
1. Establish a Centralized Identity Inventory Across All Applications
A centralized identity inventory provides visibility into user accounts, permissions, and access relationships across the organization. Without this visibility, IT and security teams may overlook accounts in disconnected applications, cloud environments, or legacy systems.
Organizations should maintain an inventory that includes employee identities, privileged accounts, service accounts, and external users. Each identity should be linked to an accountable owner, employment status, and relevant access permissions.
Automated identity discovery tools can collect account and entitlement data from identity providers, SaaS applications, and on-premises systems. Regular reconciliation helps identify duplicate accounts, unmanaged identities, and permissions that no longer match business requirements.
2. Integrate HR Systems with IAM and IGA Workflows
The human resources information system (HRIS) should serve as the authoritative source of truth for all employee JML triggers, including hiring, role changes, transfers, and terminations. Integrating HRIS data with identity and access management (IAM) and identity governance and administration (IGA) platforms enables these events to trigger automated access changes.
For example, a new employee record should initiate account provisioning, a department transfer should trigger permission adjustments, and a termination event should initiate access revocation. These workflows should operate through closed-loop automation, connecting lifecycle events to actual changes in application permissions rather than simply generating notifications or IT tickets.
Organizations should maintain accurate HRIS records and verify that provisioning and deprovisioning actions succeed across connected systems. Automated reconciliation, error handling, and completion logs help identify failed changes and provide evidence that access matches the employee's current status.
3. Define Role-Based Access Policies and Enforce Least Privilege
Role-based access control (RBAC) helps organizations standardize permissions according to job responsibilities. Instead of granting access individually for every employee, administrators can define access packages for common roles and assign them during onboarding or role changes.
These policies should follow the principle of least privilege, ensuring employees receive only the permissions necessary for their work. Sensitive resources and privileged functions should require additional approval or stronger authentication controls.
Organizations should review role definitions regularly to ensure they reflect current business requirements. Attribute-based access control (ABAC) can supplement RBAC when permissions depend on factors such as department, location, project assignment, or employment type.
4. Automate Employee Onboarding and Access Provisioning
Automated onboarding reduces the time and effort required to create accounts and grant initial access. When a new employee is registered in the HR system, automated workflows can create their identity, assign standard permissions, and provision accounts in required applications.
Provisioning workflows should use predefined access policies rather than copying permissions from existing employees. This reduces the risk of granting excessive access and helps maintain consistent security controls across departments.
Organizations can use standards such as System for Cross-domain Identity Management (SCIM) to automate account provisioning in supported applications. Workflows should also include approval steps for sensitive permissions and verification checks to confirm that provisioning actions completed successfully.
5. Continuously Adjust Permissions When Employees Change Roles
Employee role changes should trigger access reviews to ensure permissions remain aligned with current responsibilities. Organizations should avoid simply adding new entitlements without evaluating whether existing access is still necessary.
Automated mover workflows can compare an employee's current permissions with the access requirements of their new role. Permissions associated with previous responsibilities should be removed unless there is a documented business justification for retaining them.
For temporary assignments, organizations can use time-limited access grants that expire automatically. Periodic access certifications and entitlement usage analysis can further identify unnecessary permissions and reduce privilege creep.
6. Revoke Unnecessary Access Immediately During Offboarding
Offboarding procedures should ensure that departing employees lose access to organizational resources at the appropriate termination time. Delays in account deactivation can leave valid credentials and active sessions available for unauthorized use.
Automated deprovisioning workflows should disable accounts, revoke authentication sessions, remove group memberships, and terminate access to connected applications. Privileged credentials, shared secrets, and other authentication methods accessible to departing employees should also be reviewed and rotated when necessary.
Organizations should verify that access removal succeeds across all relevant systems, including applications outside centralized IAM platforms. Failed deprovisioning actions should generate alerts and remediation tasks so security teams can resolve remaining access promptly.
7. Monitor Identity Lifecycle Events and Access Changes Continuously
Continuous monitoring helps organizations detect unauthorized permission changes, failed provisioning workflows, and inconsistencies between employee records and active accounts. Security teams should collect identity lifecycle events from HR systems, identity providers, IAM platforms, and business applications.
Important events include account creation, privilege elevation, role changes, access revocation, and authentication activity involving inactive identities. Correlating these events can reveal suspicious patterns, such as a terminated employee's account remaining active or receiving new permissions.
Organizations can integrate identity logs with security information and event management (SIEM) platforms to support alerting and investigation. Regular reporting on provisioning failures, overdue access reviews, and deprovisioning completion times helps measure the effectiveness of JML controls.
8. Extend Lifecycle Governance to Contractors and Third-Party Users
Contractors, consultants, vendors, and other external users often require access to internal applications and sensitive data. However, these identities may not appear in standard HR systems, making them more difficult to track through traditional employee lifecycle workflows.
Organizations should establish separate onboarding, access modification, and offboarding procedures for external identities. Each account should have an internal sponsor, documented business purpose, defined access scope, and expiration date.
Time-limited permissions and automated access expiration can reduce the risk of third-party accounts remaining active after contracts end. Organizations should also require periodic access reviews and promptly revoke permissions when external users complete their assignments or no longer require access.
Extending JML controls to non-employees helps prevent unmanaged third-party access and ensures consistent identity governance across the organization.
9. Extend Lifecycle Governance to Non-Human and Agentic Identities
Non-human identities (NHIs), including service accounts, API keys, and AI agents, require the same JML controls as human employees. Unlike employee identities, these accounts often lack HRIS records or formal offboarding events, allowing credentials and permissions to remain active after their original purpose ends.
Organizations should establish provisioning workflows that assign each non-human identity a documented owner, business purpose, and minimum required permissions. Periodic access reviews should verify that these identities remain necessary and that their privileges match their current functions. Changes to an AI agent's scope or a service account's responsibilities should trigger entitlement reassessment.
Decommissioning workflows should automatically revoke API keys, disable service accounts, terminate active credentials, and remove unused permissions when an identity is no longer needed. Identity discovery and usage telemetry can help detect inactive agents, orphaned service accounts, and credentials that remain valid after a workload is retired.
10. Enforce Segregation of Duties and Detect Toxic Permission Combinations
Segregation of duties (SoD) controls prevent identities from holding conflicting permissions that could enable unauthorized actions. These conflicts often arise during role changes when employees receive new entitlements without losing access from previous positions. For example, an employee who can both create purchase orders and approve payments may bypass financial controls.
Organizations should define SoD policies that identify toxic permission combinations across applications and business processes. Automated mover workflows should evaluate existing and requested entitlements before granting new access, flag conflicts, and require remediation or documented approval for exceptions.
Continuous entitlement monitoring can detect conflicts introduced outside standard JML workflows, including direct permission changes and inherited group memberships. These checks should also cover service accounts and AI agents that can execute multiple sensitive operations. Integrating SoD detection with IAM and IGA platforms helps prevent access conflicts between periodic reviews.
Automating the Joiner Mover Leaver Process with Opti
Opti is an AI-native identity security platform that brings intelligence and automation to every stage of the joiner mover leaver lifecycle. Opti connects to your existing IdP, HRIS, ITSM, and enterprise applications, both SaaS and legacy, so employment changes in your HR system drive access decisions across the environment. Its AI engine analyzes real access patterns and business context to recommend least-privilege access, keep entitlements aligned as roles change, and resolve identity risks with human approval where it matters, with or without an existing IGA.
Key capabilities of Opti:
HR-driven access administration: Opti integrates with your HRIS and existing identity stack, ingesting entitlements and executing changes through the systems you already trust, so onboarding, role changes, and offboarding are tied to authoritative employment data.
Least-privilege access for joiners: Opti suggests least-privilege access at the point of onboarding based on role, team, and peer behavior, ensuring new users get only what they need and nothing more.
Automated role adjustments for movers: As users move across teams or take on new responsibilities, Opti dynamically recalibrates their entitlements, replacing outdated access with the most appropriate least-privilege alternatives.
AI-driven access reviews across the lifecycle: Intent-aware recommendations aligned with business context replace guesswork and rubber stamping, giving reviewers the analytics they need to approve or remove access at each lifecycle stage.
Closed-loop remediation from detection to revocation: Opti doesn't just flag risk, it remediates it. From over-privileged access to orphaned accounts, it provides a precise remediation path and executes it directly from the platform, revoking stale entitlements with human approval where needed.
Plain-English policy enforcement: Write policies in natural language, such as "Only engineers should access production systems," and Opti continuously scans for violations and recommends new policies that reinforce least privilege.
Coverage for human, non-human, and agentic identities: Opti's identity fabric ingests, normalizes, and analyzes all identities across your applications, extending lifecycle governance beyond employees.
Continuous compliance evidence: Opti continuously aggregates identity, access, and entitlement data and maps it to roles, policies, and usage, so audits don't become a fire drill.
Fast deployment with 250+ integrations: Opti deploys in hours and integrates with existing identity solutions and business applications, including homegrown apps.
Ready to replace manual JML workflows with AI-driven lifecycle governance? Book a demo of Opti.
