Joiner-Mover-Leaver (JML)
The joiner-mover-leaver (JML) process is the set of identity changes triggered when someone joins an organization (joiner: create accounts and grant birthright access), changes role (mover: add new access and remove old access) or leaves (leaver: disable accounts and revoke access). Automating JML from the HR system is the core of user lifecycle management and a core IGA capability.
| Event | Trigger | Must happen |
|---|---|---|
| Joiner | Hire record in HR | Accounts and birthright roles ready on day one, first credential issued safely |
| Mover | Department, title or manager change | New-role access added and old-role access removed in the same change |
| Leaver | Termination or end date | Accounts disabled, sessions and tokens revoked, owned assets reassigned |
Mover is the event everyone under-invests in and auditors always find. Joiners get access because someone is waiting to work, leavers get removed because HR triggers it, but transfers accumulate: the new role's access is added and the old role's is never taken away, producing employees whose entitlements are an archaeology of their career. Automated mover handling is what keeps least privilege true over time.
See also: deprovisioning, provisioning, what is IGA, access certification
Related on Start with Identity
- GlossaryOrphaned Account
An active account with no valid owner, typically left behind after someone leaves or changes roles. A common audit finding and a soft target for attackers. Orph
- GlossaryAgent Registry
An agent registry is an inventory of the AI agents an organization runs or allows, recording for each one its identity, accountable human owner, purpose, permis
- GlossaryCIEM
Cloud Infrastructure Entitlement Management. Tools that discover and right-size identities and permissions across AWS, Azure, and GCP, reducing excessive and un
- TemplateJoiner-Mover-Leaver Procedure Template
A step-by-step joiner, mover and leaver procedure with a fill-in SLA table, the evidence auditors sample for each event, and the control each step maps to in NI
- GuideUser Lifecycle Management: Automating Joiner-Mover-Leaver Processes
Complete guide to automating the user lifecycle from onboarding through role changes to offboarding, including orphan account detection and provisioning workflo
- PodcastIdentity at the Center
The longest-running weekly show on identity and access management programs, hosted by two practitioners. The best single feed for keeping up with the field.