Joiner, mover, leaver
Quick answer
Lifecycle events are triggers IdentityIQ fires when an identity changes state, a joiner appears, a mover changes department, or a leaver is terminated. Each event runs configured logic, such as provisioning birthright access for joiners or disabling all accounts for leavers.
Key takeaways
- Events fire on identity state changes from HR data
- Joiner: provision birthright access automatically
- Mover: add new-role access, remove old access
- Leaver: disable or delete all accounts promptly
- Reduces manual tickets and closes security gaps
Lifecycle events (and, in Identity Security Cloud, lifecycle states) are how IdentityIQ automates the joiner, mover and leaver process, reacting to changes in the authoritative source to grant, adjust and revoke access automatically. They are the mechanism that makes the identity lifecycle real.
Joiner, mover, leaver
- Joiner, on hire, create the identity and provision birthright access.
- Mover, on department/role change, grant new access and remove old.
- Leaver, on termination, disable immediately then fully deprovision.
How events fire
When the authoritative source changes an attribute (hire, transfer, termination), aggregation brings the change in, identity refresh detects it, and the matching lifecycle event fires the appropriate provisioning. Clean authoritative data and a reliable refresh cadence are prerequisites, events are only as timely as the HR feed.
Why movers matter most for hygiene
Joiner and leaver get the attention, but the mover event is where privilege creep is either reversed or accelerated. A mover that only adds new access, without removing the old, quietly builds the over-privilege that certifications later have to clean up. Design movers to revoke as well as grant.
Common pitfalls
- Movers that only add access, never removing the old.
- Late or wrong HR data firing events at the wrong time.
- Slow leaver processing leaving orphaned access.
Want to learn this properly?
Our live, instructor-led SailPoint Training covers this hands-on, with real projects and a certification path.
Check your understanding
Lifecycle events are triggered by?
- A. Identity state changes from HR. Events fire when identity attributes change, usually from the HR source.
- B. Leaver. A missed leaver leaves active accounts an attacker can exploit.
- C. Identity refresh. Refresh after aggregation detects changes and fires events.
Show answer
A. Identity state changes from HR. Events fire when identity attributes change, usually from the HR source.
Identity state changes from HR. Events fire when identity attributes change, usually from the HR source.
The highest-risk lifecycle event is the?
- A. Identity state changes from HR. Events fire when identity attributes change, usually from the HR source.
- B. Leaver. A missed leaver leaves active accounts an attacker can exploit.
- C. Identity refresh. Refresh after aggregation detects changes and fires events.
Show answer
B. Leaver. A missed leaver leaves active accounts an attacker can exploit.
Leaver. A missed leaver leaves active accounts an attacker can exploit.
Lifecycle events are evaluated during?
- A. Identity state changes from HR. Events fire when identity attributes change, usually from the HR source.
- B. Leaver. A missed leaver leaves active accounts an attacker can exploit.
- C. Identity refresh. Refresh after aggregation detects changes and fires events.
Show answer
C. Identity refresh. Refresh after aggregation detects changes and fires events.
Identity refresh. Refresh after aggregation detects changes and fires events.