Last updated: July 2026
Most organizations can grant access in hours but take days to remove it, and that gap is exactly where breaches happen. Identity lifecycle management is the discipline that closes it. This guide explains what identity lifecycle management is, the joiner-mover-leaver model at its core, why each stage carries risk, and how automation turns a manual, error-prone process into a reliable control.
What is identity lifecycle management?
Identity lifecycle management (ILM) is the end-to-end process of governing an identity and its access from the moment it is created, through every change it accumulates, to its eventual removal. It ensures that every identity, human or machine, has the right access at the right time, and nothing more, at each stage of its existence.
At its core, identity lifecycle management is an event-driven control system. An authoritative source, usually the HR platform for employees, signals a change, and that signal triggers an automated response: provisioning access on arrival, adjusting it when a role changes, and revoking it on departure. The goal is simple to state and hard to achieve manually: access should always reflect a verifiable fact about who someone is and what they do right now.
Identity lifecycle management is a foundational capability of identity governance and administration (IGA). Governance decides what access is appropriate; lifecycle management makes sure that access is actually granted, changed, and removed in step with reality.
The joiner-mover-leaver (JML) model
Identity lifecycle management is built around three canonical transitions, known as the joiner-mover-leaver, or JML, model. Each stage has a distinct purpose and a distinct failure mode.
Joiner: onboarding
When someone joins, they need access to do their job from day one, but only the access their role requires. A new HR record triggers automated provisioning: directory and email accounts are created, birthright entitlements are assigned based on attributes like department and location, and tickets are opened for anything that needs manual setup. Done well, a new hire is productive immediately. Done poorly, they either wait days for access or receive far more than they need.
Mover: role changes
When someone changes role, is promoted, or transfers teams, their access should change with them. This is the stage organizations most often get wrong. The right approach treats every role change as a mini-offboarding: remove the access tied to the old role before adding access for the new one. When that does not happen, permissions simply accumulate, a problem known as privilege creep.
Leaver: offboarding
When someone leaves, their access must be revoked immediately and completely, across every connected system. This is the most time-sensitive stage in the entire lifecycle, because in most organizations the HR action and the IT action happen in separate systems with no automated connection. That gap is where former-employee access lingers, and where much of the risk lives.
Why each stage of the lifecycle carries risk
The security case for identity lifecycle management is easiest to see through its failures. Over-provisioning at onboarding needlessly expands the attack surface. Privilege creep during a person’s tenure creates dormant permissions that add risk without adding value. And incomplete offboarding leaves behind valid credentials that attackers, or disgruntled former staff, can exploit.
The offboarding numbers are the most alarming. According to Security Magazine, only 34% of organizations revoke system access on the day an employee leaves, and for half of all organizations it takes even longer. Separate analysis cited by ID Dataweb found that 20% of companies have experienced a breach tied to ex-employee accounts, and that roughly half of ex-employees still retain access to corporate applications after departure. One study found 32% of companies need more than a week to disable all access for leavers, a full week in which a borrowed password roams free.
The scale underneath this is enormous. A firm with ten thousand employees and two hundred applications can be juggling around two million entitlements, and industry analysis suggests over 95% of multi-cloud permissions granted go unused, pure risk with no benefit. Manual reviews, spreadsheets, and ticketing systems cannot keep that under control.
Manual versus automated lifecycle management
Many organizations run identity changes through ticketing systems like ServiceNow or Jira. These tools were never designed for identity lifecycle management, and using them for it introduces delays, incomplete updates, and fragmented audit trails. When access changes depend on someone remembering a thirty-step exit playbook, mistakes are inevitable, and shadow IT makes it worse: any SaaS tool that IT does not know about is simply left off the offboarding checklist.
Automated identity lifecycle management replaces memory with triggers. Platforms integrate directly with HR systems and applications, so access is provisioned, updated, or revoked at machine speed the moment a JML event fires. A termination in the HR system launches a reverse-provisioning sequence, disabling SSO, reclaiming licenses, closing VPN access, and logging every action, within minutes rather than days. The open SCIM standard is central to this, syncing identity changes across every connected application automatically and cutting access-change times from days to minutes.
One capability separates mature automation from basic provisioning: session and token revocation. Deprovisioning must kill active sessions, not just block future logins, because a user logged in at the moment of offboarding keeps live access until their session expires unless the system explicitly terminates it. This step is frequently overlooked and consistently exploited.
Beyond employees: contractors, service accounts, and AI agents
By 2026, the identity lifecycle covers far more than employees. Contractors rarely appear in the core HR feed, so their accounts must be tied to a vendor-management system and forced to expire automatically at project end. Service accounts and other machine identities need their own lifecycle, with credential rotation and retirement, because long-lived keys are a standing risk.
AI agents are the hardest new case, because they break the model’s core assumption. The joiner-mover-leaver model works because human employment generates a continuous stream of structured events. An AI agent enters production through a deployment pipeline, with no HR record, no approval chain, and no owner attached, and when it is retired, no equivalent leaver signal fires. Its credentials persist in secrets managers and OAuth servers long after the workload is gone. Extending lifecycle discipline to these non-human identities, giving each an owner, a purpose, and a defined end, is now one of the central challenges of identity lifecycle management.
How to implement identity lifecycle management
A practical rollout prioritizes the stages that reduce the most risk first. Automate the joiner and leaver steps first, since they deliver the biggest security gain quickly, then add mover controls to stop privilege creep. Connect an authoritative source (the HR system) so events drive changes automatically rather than relying on tickets. Extend coverage beyond the easy SCIM-enabled apps to the long tail of legacy and niche tools, because that is precisely where offboarding failures and audit findings happen.
Two metrics are worth tracking throughout: time-to-provision, which measures new-hire productivity, and time-to-deprovision, which measures risk exposure. The organizations that succeed pair the right platform with the operating model and integration work to make it reach every corner of the estate. A dedicated identity governance and administration solution combined with expert integration turns identity lifecycle management from a quarterly fire drill into continuous, auditable control.
Frequently asked questions
What is identity lifecycle management?
Identity lifecycle management is the process of governing an identity and its access from creation, through every change, to removal. It ensures every identity, human or machine, has the right access at each stage, usually automated through the joiner-mover-leaver model.
What does JML stand for?
JML stands for Joiner, Mover, Leaver, the three moments when access must change: onboarding (joiner), role changes (mover), and offboarding (leaver). It is the backbone of identity lifecycle management.
Why is offboarding the riskiest stage?
Because HR and IT actions usually happen in separate systems with no automated link, former-employee access often lingers. Only 34% of organizations revoke access on the day someone leaves, and around half of ex-employees retain some access afterward, creating a direct breach path.
What is the difference between provisioning and deprovisioning?
Provisioning grants and configures access when an identity is created or changes role. Deprovisioning removes it when access is no longer needed. Effective deprovisioning must also revoke active sessions and tokens, not just block future logins.
Does identity lifecycle management cover non-human identities?
Increasingly, yes. Contractors, service accounts, and AI agents all need lifecycle governance, but they do not generate the HR events the model was built around, so they require dedicated ownership, credential rotation, and defined retirement to avoid orphaned access.
Key takeaways
- Identity lifecycle management governs access across the joiner-mover-leaver journey, ensuring every identity has the right access at each stage and none left over.
- Offboarding is the riskiest stage: only 34% of organizations revoke access on the day an employee leaves, and lingering access is a leading breach path.
- Automation through HR triggers, SCIM, and session revocation turns lifecycle management from an error-prone manual task into reliable, auditable control, and it must now extend to machine and AI agent identities.
