Identity lifecycle

The identity lifecycle is the arc a person travels through in relation to an organisation, from the day they are hired, through every role change, to the day they leave (and sometimes back again as a rehire). Identity governance exists to make access follow that arc automatically, so that at every moment a person holds exactly the access their current status justifies, no more and no less.

When a new worker appears in the authoritative source, the joiner process creates their identity cube and provisions birthright access, the baseline every person in that role, department and location needs on day one. The goal is day-one productivity with zero manual tickets: the new hire logs in and their core accounts already exist.

When someone changes department, manager, job title or employment type, the mover process adjusts their access to match the new position. Crucially, this means removing access tied to the old role as well as granting the new. Movers are where privilege creep is either reversed or, if handled carelessly, accelerated.

On termination, the leaver process removes all access, typically disabling accounts immediately to stop access fast, then fully deprovisioning as cleanup completes. Prompt, complete offboarding is the most important single control for reducing orphaned-account and insider risk.

Rehires, long-term leave, contract extensions and conversions from contractor to employee are all lifecycle transitions too. Mature programmes handle these explicitly rather than treating them as edge cases.

Lifecycle events are driven by changes in the authoritative source. When HR marks someone as hired, transferred or terminated, aggregation brings that change into SailPoint, identity refresh detects the changed attribute, and a configured lifecycle event (in IdentityIQ) or lifecycle state transition fires the appropriate provisioning. This is why clean authoritative data and a reliable refresh cadence are prerequisites: the lifecycle is only as timely and accurate as the HR feed behind it.

• Orphaned accounts from manual offboarding are a perennial top audit finding and a real breach vector.
• Slow onboarding costs productivity and frustrates new hires and their managers.
• Inconsistent handling across teams undermines every downstream control.

Automating joiner, mover and leaver replaces all of that with a consistent, logged, auditable process that runs the same way every time.

• Define birthright carefully. Too little and new hires raise tickets on day one; too much and you institutionalise over-privilege.
• Handle the timing of leavers. Immediate disable protects fast; graceful deprovisioning handles mailboxes, data ownership and manager reassignment.
• Plan for imperfect HR data. Late or wrong feeds cause wrong-time provisioning; build tolerance and alerting.

See the Joiner, mover, leaver lesson for the specific IdentityIQ mechanics of lifecycle events and states.