A lifecycle model for creating, changing, and removing digital access as a person's relationship or role changes.

A standards-track HTTP protocol and schema framework for managing identity resources such as users and groups across domains.

Baseline access automatically assigned because of a verified worker type, role, or organizational relationship.

An account that remains active but has no valid, active identity or approved business owner associated with it.

System for Cross-domain Identity Management, an HTTP-based standard for provisioning and managing identity resources such as users and groups.

A specific permission, group membership, application role, license, or privilege assigned to an identity.

What is access request?

A formal request to grant, change, or remove an entitlement, normally including business justification and approval evidence.

What is deprovisioning?

Disabling, removing, or otherwise revoking accounts, entitlements, sessions, and access paths.

The Joiner-Mover-Leaver Pipeline — Enterprise IAM and Zero Trust Architecture

1. Think of Identity as a Pipeline

Access Starts Before Login

A login is the final visible step. The security decision often began earlier, when an HR, contractor, or student record created or changed an identity.

Three Lifecycle Events

Joiner: create the right access
Mover: replace outdated access
Leaver: remove access quickly and completely

The Pipeline Model

Authoritative record -> identity platform -> policy and approvals -> target applications -> reconciliation. The final check confirms that the intended state became the actual state.

2. Start with an Authoritative Identity Source

One Fact, One Owner

An authoritative source is trusted for a specific fact. HR may own employment status, while vendor management owns contractor end dates. Do not let every application edit both.

Use a Durable Identifier

Use an immutable internal ID, such as `E10482`, to correlate records. Email addresses, display names, and usernames may change during a person's lifecycle.

Data Quality Is a Security Control

Require key lifecycle fields: status, manager or sponsor, worker type, start date, and end date. Missing fields create ambiguous access decisions.

3. Build the Joiner Workflow

Joiner Does Not Mean Full Access

A new identity should receive only the access needed to begin work. Treat high-impact entitlements as separate, reviewable decisions.

A Reliable Sequence

Verify event -> validate attributes -> match identity -> assign baseline access -> approve elevated access -> provision -> verify and log.

Avoid Duplicate Identities

Rehires and contractors converting to employees can already have accounts. Match with a durable identifier before creating a new account.

4. Automate Changes with Events and SCIM

Events Trigger Decisions

A status or role change should produce an event. The identity platform then evaluates policy instead of waiting for a person to notice a stale account.

What SCIM Does

SCIM uses HTTP to manage identity resources such as users and groups across systems. It can create, update, retrieve, and deactivate supported resources.

What SCIM Does Not Do

SCIM does not decide whether Maya deserves access. Governance policy, role logic, risk rules, and approvals make that decision before provisioning occurs.

5. Read a SCIM Deprovisioning Update

SCIM Example: Disable an Account

A common leaver action is to set the SCIM `active` attribute to `false`. The target system must interpret and enforce that state correctly.

```http

PATCH /scim/v2/Users/2819c223-7f76-453a-919d-413861904646 HTTP/1.1

Content-Type: application/scim+json

Authorization: Bearer <provisioning-token>

{

"schemas": [

"urn:ietf:params:scim:api:messages:2.0:PatchOp"

"Operations": [

{

"op": "Replace",

"path": "active",

"value": false

}

]

}

```

Read it step by step

`PATCH` changes part of an existing user resource.
The path identifies the target user by a system identifier, not by display name.
`active: false` requests deactivation.
The response and audit record determine whether the change actually succeeded.

Do not stop at the API call. A successful HTTP response does not prove that all active sessions, API tokens, local roles, or downstream copies were revoked. Build follow-up checks for those separate controls.

SCIM defines identity-resource management over HTTP and relies on transport security plus suitable authentication and authorization for the provisioning connection.

6. Handle Movers Without Accumulating Access

Why Movers Matter

Movers already have access. If the process only adds permissions, old roles persist and privilege grows quietly over time.

Calculate the Delta

`desired state - current state` identifies both additions and removals. The removal side is the control most teams forget.

Separate Risk Levels

Automate low-risk birthright access. Require stronger evidence, approval, SoD checks, and expiry for sensitive or privileged access.

7. Engineer the Leaver Workflow for Speed and Completeness

Block Sign-In First

For a leaver, stop new authentication at the identity provider first. Then remove sessions, tokens, privileges, and target application accounts.

Termination Is More Than One Account

Check multiple paths: SaaS sessions, API tokens, VPN, administrator roles, shared accounts, devices, and local application accounts.

Contractors Need Expiry

Require a sponsor and end date. Make extension an explicit action; do not let access continue because nobody remembered to close a ticket.

8. Design a Failure-Resistant Pipeline

Thought Exercise: Find the Breakpoints

A contractor, Priya, has a contract ending today. Her vendor-management record sends a termination event at 5:00 PM.

The identity platform disables Priya's central account.
The SCIM connector to a project-management SaaS application returns an error.
Priya's SaaS account remains active.
Priya also has a local account in a legacy reporting tool that is not connected to the identity platform.

Your task

Write a response plan using these four questions:

Detection: How will the organization learn that the SaaS deprovisioning failed?
Containment: What action blocks Priya's access while the connector is repaired?
Ownership: Who owns remediation: the identity team, application owner, vendor manager, or all three?
Prevention: What design change prevents the same failure from becoming an unnoticed orphan account?

A strong answer includes

A failed-provisioning queue with severity and escalation timers
A fallback manual deprovisioning runbook for high-risk applications
Reconciliation that compares active application accounts with active authoritative identities
A documented application owner for every connector and unmanaged application
An exception record with a target completion time

Lifecycle metrics to calculate

Provisioning time = account-ready timestamp - approved-start timestamp
Revocation time = access-blocked timestamp - termination-event timestamp
Orphan-account rate = active accounts with no valid active identity / total active accounts
Provisioning failure rate = failed provisioning actions / total provisioning actions

Use percentiles as well as averages. A low average revocation time can hide a small number of dangerously delayed terminations.

9. Review the Core Terms

Flip the Cards

Use these terms to review the control points in a joiner-mover-leaver pipeline.

Authoritative identity source: The system trusted to provide a specific identity attribute, such as employment status or contractor end date.
Joiner-mover-leaver: A lifecycle model for creating, changing, and removing digital access as a person's relationship or role changes.
SCIM: A standards-track HTTP protocol and schema framework for managing identity resources such as users and groups across domains.
Birthright access: Baseline access automatically assigned because of a verified worker type, role, or organizational relationship.
Orphan account: An account that remains active but has no valid, active identity or approved business owner associated with it.
Reconciliation: A comparison between expected identity and access data and the actual accounts and entitlements found in target systems.
Revocation time: The elapsed time from a termination or suspension event to confirmed removal of access.

10. Check Your Design Decision

Scenario

An employee transfers from Sales to Legal. The identity platform automatically adds Legal groups but leaves all Sales entitlements in place. What is the most important improvement?

Which control most directly prevents access accumulation during the transfer?

Require the employee to reset their password after the transfer.
Compare current entitlements with the new role's desired state and remove no-longer-justified access.
Create a second account for the employee in Legal.
Ask the employee to report which Sales applications they no longer need.

Show Answer

Answer: B) Compare current entitlements with the new role's desired state and remove no-longer-justified access.

A mover workflow must calculate both additions and removals. Password changes do not remove authorization, duplicate accounts worsen governance, and self-reporting is not a reliable revocation control.

Key Terms

SCIM: System for Cross-domain Identity Management, an HTTP-based standard for provisioning and managing identity resources such as users and groups.
entitlement: A specific permission, group membership, application role, license, or privilege assigned to an identity.
access request: A formal request to grant, change, or remove an entitlement, normally including business justification and approval evidence.
deprovisioning: Disabling, removing, or otherwise revoking accounts, entitlements, sessions, and access paths.
orphan account: An account that is active without a valid active identity, approved owner, or justified relationship.
reconciliation: A process that compares the expected identity state with actual accounts and permissions in target systems.
revocation time: Time elapsed from a termination or suspension event until access is confirmed blocked or removed.
birthright access: Baseline access assigned automatically from verified role or relationship attributes.
joiner-mover-leaver: An identity lifecycle approach that governs access when people join, change roles, or leave.
event-driven workflow: A workflow initiated by a state change event, such as a hire, transfer, contract extension, or termination.
segregation of duties: A control that prevents one person from holding conflicting permissions that could enable error, fraud, or unauthorized activity.
authoritative identity source: A system trusted to provide a particular identity fact, such as employment status, manager, or contractor end date.