Joiner-Mover-Leaver (JML)
The three lifecycle events that drive identity changes: new hires (joiner), internal transfers (mover), and departures (leaver). JML automation is a core IGA capability.
Mover is the event everyone under-invests in and auditors always find. Joiners get access because someone is waiting to work, leavers get removed because HR triggers it, but transfers accumulate: the new role's access is added and the old role's is never taken away, producing employees whose entitlements are an archaeology of their career. Automated mover handling is what keeps least privilege true over time.
See also: deprovisioning, provisioning, what is IGA, access certification
Related on Start with Identity
- GlossaryOrphaned Account
An active account with no valid owner, typically left behind after someone leaves or changes roles. A common audit finding and a soft target for attackers. Orph
- GlossaryCIEM
Cloud Infrastructure Entitlement Management. Tools that discover and right-size identities and permissions across AWS, Azure, and GCP, reducing excessive and un
- GlossaryEntitlement
A specific permission or right an identity holds over a resource. Governance and CIEM exist to keep entitlements understood, justified, and minimal. Entitlement
- GuideUser Lifecycle Management: Automating Joiner-Mover-Leaver Processes
Complete guide to automating the user lifecycle from onboarding through role changes to offboarding, including orphan account detection and provisioning workflo
- BlogServiceNow closes its Veza acquisition at about 1.2 billion dollars
Announced in December 2025 and closed on 2 March 2026, substantially in cash. Veza, valued at 808 million dollars in its Series D, now supplies the permission g
- TechniqueMover entitlement accumulation
An employee who changes roles keeps every entitlement from every prior role, because provisioning adds access automatically and nothing removes the old access a