JOINER • MOVER • LEAVER
Employee account lifecycle management with Microsoft Entra ID
IT Systems designs employee account lifecycle processes from onboarding and role changes through offboarding in Microsoft Entra ID. The goal is to grant the right access, revoke it on time and retain clear operational evidence.
Automation works only when HR data, approvers, trigger conditions and exception handling are clearly defined.
Access rights must follow the employee lifecycle
Slow account creation disrupts onboarding, retained permissions create risk after role changes, and incomplete offboarding can leave mailboxes, sessions, devices and applications accessible.
Consistent joiner experience
Standardize accounts, groups, licenses, applications and the first-day checklist.
Movers do not retain old access
Review the previous role and remove obsolete access before granting new permissions.
Evidence-based leaver process
Block sign-in, revoke sessions, licenses and app access, and retain completion logs.
Six control layers for Joiner–Mover–Leaver
Source data
- HR system or request form.
- Effective date and manager.
Accounts and groups
- Naming convention.
- Dynamic or assigned groups.
Licenses and applications
- Role-based assignment.
- Revocation and reuse.
Approval
- Business owner.
- Separation of duties.
Offboarding
- Block sign-in and revoke sessions.
- Mailbox, data and devices.
Audit and exceptions
- Workflow history.
- Owned and time-bound exceptions.
JOINER → MOVER → LEAVER
A workflow needs conditions, tasks and completion evidence
Microsoft Entra Lifecycle Workflows can orchestrate lifecycle tasks based on defined conditions. The business must still establish source data, ownership, timing, non-Microsoft applications and error handling.
- Standardize HR attributes used by workflow conditions.
- Separate automated tasks from approval steps.
- Monitor workflow history, failures and retries.
- Periodically review inactive accounts and privileged access.
Employee account lifecycle implementation process
1. Assessment
Map HR, IT and manager workflows, source systems, SLAs and current exceptions.
2. Design
Define role bundles, JML checklists, approvals, retention and evidence.
3. Pilot
Test joiner, mover and leaver scenarios in one representative business unit.
4. Operate
Measure SLAs, workflow failures and stale accounts, and update the process as the organization changes.
Employee lifecycle workstreams
Stage
Core activities
Evidence or output
Joiner
Create the user, manager, groups, licenses, apps, mailbox and sign-in guidance.
Checklist completed before the effective date.
Mover
Compare old and new roles, remove obsolete access and assign new permissions.
Approved access matrix.
Leaver
Block sign-in, revoke sessions, remove licenses and apps, and handle mailbox and data.
Timestamped completion log.
Exceptions
Handle contractors, extended leave, service accounts and legal hold.
Owner, rationale and expiry date.
Review
Review inactive users, privileged access, groups and unused licenses.
Periodic report and action list.
Related solutions
Frequently asked questions about account lifecycle management
What is Joiner–Mover–Leaver?
It describes onboarding, role changes and offboarding, the three stages used to standardize identity and access changes.
Can the process be fully automated?
Not every step. Repetitive tasks can be automated, while approvals, exceptions, source data and external applications still need governance.
Which license is required for Lifecycle Workflows?
The capability is available through Microsoft Entra ID Governance or Microsoft Entra Suite. Eligibility should be checked for the tenant.
What should happen immediately during offboarding?
Common actions include blocking sign-in, revoking sessions, and handling MFA, groups, apps, licenses, mailbox, OneDrive and devices.
Who owns HR identity data?
HR or the source system owns attributes and effective dates, IT operates workflows, and managers or business owners approve access.
Can this cover non-Microsoft applications?
Yes, depending on connectors and application APIs. Unsupported systems need a controlled manual step.
Need consistent account onboarding and offboarding?
IT Systems works with HR and IT to review source data, role-based access and applications, then designs workflows with clear SLAs, owners and evidence.
Process map • Role bundles • Pilot • Audit