Identity lifecycle
The identity lifecycle concept: how access should change automatically as a person joins, moves and leaves an organization.
The identity lifecycle is the arc from hire to departure. Governance automates access at each stage so people always have exactly the right access for their current status.
- Lifecycle = join, move, leave (and rehire)
- Access should change automatically with status
- Driven by authoritative-source attribute changes
- Reduces orphaned accounts and access drift
The identity lifecycle is the arc a person travels through in relation to an organisation, from the day they are hired, through every role change, to the day they leave (and sometimes back again as a rehire). Identity governance exists to make access follow that arc automatically, so that at every moment a person holds exactly the access their current status justifies, no more and no less.
The stages, and what each should do to access
Joiner
When a new worker appears in the authoritative source, the joiner process creates their identity cube and provisions birthright access, the baseline every person in that role, department and location needs on day one. The goal is day-one productivity with zero manual tickets: the new hire logs in and their core accounts already exist.
Mover
When someone changes department, manager, job title or employment type, the mover process adjusts their access to match the new position. Crucially, this means removing access tied to the old role as well as granting the new. Movers are where privilege creep is either reversed or, if handled carelessly, accelerated.
Leaver
On termination, the leaver process removes all access, typically disabling accounts immediately to stop access fast, then fully deprovisioning as cleanup completes. Prompt, complete offboarding is the most important single control for reducing orphaned-account and insider risk.
Rehire and other transitions
Rehires, long-term leave, contract extensions and conversions from contractor to employee are all lifecycle transitions too. Mature programmes handle these explicitly rather than treating them as edge cases.
What triggers a lifecycle event
Lifecycle events are driven by changes in the authoritative source. When HR marks someone as hired, transferred or terminated, aggregation brings that change into SailPoint, identity refresh detects the changed attribute, and a configured lifecycle event (in IdentityIQ) or lifecycle state transition fires the appropriate provisioning. This is why clean authoritative data and a reliable refresh cadence are prerequisites: the lifecycle is only as timely and accurate as the HR feed behind it.
Why automation is non-negotiable at scale
- Orphaned accounts from manual offboarding are a perennial top audit finding and a real breach vector.
- Slow onboarding costs productivity and frustrates new hires and their managers.
- Inconsistent handling across teams undermines every downstream control.
Automating joiner, mover and leaver replaces all of that with a consistent, logged, auditable process that runs the same way every time.
Design considerations
- Define birthright carefully. Too little and new hires raise tickets on day one; too much and you institutionalise over-privilege.
- Handle the timing of leavers. Immediate disable protects fast; graceful deprovisioning handles mailboxes, data ownership and manager reassignment.
- Plan for imperfect HR data. Late or wrong feeds cause wrong-time provisioning; build tolerance and alerting.
See the Joiner, mover, leaver lesson for the specific IdentityIQ mechanics of lifecycle events and states.