Builds comprehensive identity governance and lifecycle management processes including joiner-mover-leaver automation, role mining, access request workflows, periodic recertification, and orphaned account remediation using IGA platforms. Activates for requests involving identity lifecycle management, JML processes, role-based access provisioning, or identity governance program design.
Builds comprehensive identity governance and lifecycle management processes including joiner-mover-leaver automation, role mining, access request workflows, periodic recertification, and orphaned account remediation using IGA platforms. Activates for requests involving identity lifecycle management, JML processes, role-based access provisioning, or identity governance program design.
No centralized visibility into who has access to what across the enterprise
Do not use for single-application user management; identity governance addresses cross-system lifecycle management requiring correlation of authoritative HR sources with downstream application provisioning.
Common Misconfigurations & Verification
Leaver disablement that lags: the JML "leaver" job fires on HR terminationDate but downstream OAuth refresh tokens, app-specific passwords, and active Kerberos/SAML sessions survive. Verify termination also runs Revoke-MgUserSignInSession and revokes app refresh tokens, not just Disable AD account. Test by holding a token issued pre-termination and confirming it 401s within minutes.
Birthright over-grant: mining at min_assignment_pct=0.5 bakes existing over-provisioning into "birthright" roles, so role mining launders privilege creep. Confirm SoD rules run before a role is published and that mined roles are diffed against least-privilege, not the messy status quo.
Recertification rubber-stamping: reviewers bulk-approve; "auto-apply on no response" defaults to retain instead of revoke. Verify the campaign config revokes on non-response and that approvers cannot approve their own access.
Orphan correlation gaps: accounts with no employee_id (contractors, service accounts, shared mailboxes) are skipped entirely rather than flagged HIGH. Confirm uncorrelated accounts surface in the report.
Verification: reconcile IGA active-identity count against each connected app's account list and assert the delta equals known service accounts; pull the last termination event and confirm AD disable + token revocation + group removal timestamps are all within SLA.
Prerequisites
Authoritative HR system (Workday, SAP SuccessFactors, BambooHR) as identity source of truth
IGA platform (SailPoint, Saviynt, One Identity) or Microsoft Entra ID Governance
Active Directory and/or Azure AD as primary directory services
Application connectors for target systems requiring automated provisioning
Defined organizational role structure and reporting hierarchy
Stakeholder buy-in from HR, IT, security, and business unit managers
Workflow
Step 1: Define Identity Lifecycle States and Transitions
Map the identity lifecycle from hire to termination:
"""
Identity Lifecycle State Machine
Defines all identity states and valid transitions with automated actions.
"""
IDENTITY_LIFECYCLE = {
"states": {
"PRE_HIRE": {
"description": "Identity created from HR feed before start date",
"automated_actions": [
"Create identity record in IGA platform",
"Generate unique employee ID",
"Create mailbox reservation",
"Assign birthright roles based on job code",
"Initiate background check workflow"
],
"valid_transitions": ["ACTIVE", "CANCELLED"]
},
"ACTIVE": {
"description": "Employee has started, full access provisioned",
"automated_actions": [
"Create Active Directory account",
"Create email mailbox",
"Provision birthright application access",
"Assign department-specific roles",
"Add to distribution groups",
"Issue MFA token/security key",
"Create VPN account if remote worker"
],
"valid_transitions": ["ROLE_CHANGE", "LEAVE_OF_ABSENCE", "TERMINATED"]
},
"ROLE_CHANGE": {
"description": "Employee transferred, promoted, or changed departments",
"automated_actions": [
"Recalculate role assignments based on new job code",
"Remove access from previous department applications",
"Provision access for new department applications",
"Update group memberships",
"Transfer manager in directory",
"Trigger access review for retained entitlements",
"Notify new manager of inherited access"
],
"valid_transitions": ["ACTIVE", "LEAVE_OF_ABSENCE", "TERMINATED"]
},
"LEAVE_OF_ABSENCE": {
"description": "Employee on extended leave (medical, parental, sabbatical)",
"automated_actions": [
"Disable interactive login (preserve account)",
"Suspend VPN access",
"Set out-of-office auto-reply",
"Delegate mailbox to manager",
"Preserve all role assignments for return",
"Set reactivation date from HR feed"
],
"valid_transitions": ["ACTIVE", "TERMINATED"]
},
"TERMINATED": {
"description": "Employee has left the organization",
"automated_actions": [
"Disable AD account immediately",
"Revoke all application access",
"Revoke VPN and remote access",
"Convert mailbox to shared (manager access for 90 days)",
"Transfer OneDrive files to manager",
"Remove from all security and distribution groups",
"Revoke OAuth tokens and API keys",
"Wipe corporate data from mobile devices",
"Archive identity record",
"Schedule account deletion after retention period"
],
"valid_transitions": ["REHIRE", "DELETED"]
},
"REHIRE": {
"description": "Previously terminated employee returning",
"automated_actions": [
"Reactivate existing identity record",
"Reset credentials and require MFA re-enrollment",
"Provision based on new job code (not previous access)",
"Flag for enhanced access review in first 30 days"
],
"valid_transitions": ["ACTIVE"]
},
"DELETED": {
"description": "Account permanently removed after retention period",
"automated_actions": [
"Delete AD account",
"Delete email mailbox archive",
"Remove identity record from IGA",
"Generate deletion audit log"
],
"valid_transitions": []
}
},
"retention_periods": {
"terminated_to_deleted": "90 days (default)",
"mailbox_retention": "90 days as shared mailbox",
"onedrive_retention": "30 days manager access, then archived",
"audit_log_retention": "7 years for compliance"
}
}
Baseline entitlements automatically provisioned based on job code, department, or location without requiring an access request
Role Mining
Analysis of existing access patterns to derive role definitions by identifying common entitlement groupings across similar job functions
Orphaned Account
Application account that no longer has a corresponding active identity in the authoritative HR source, representing a security risk
Authoritative Source
System of record (typically HR) that serves as the single source of truth for identity attributes and employment status
Access Request Workflow
Self-service process enabling users to request additional entitlements with risk-based approval routing
Tools & Systems
SailPoint IdentityIQ/IdentityNow: Enterprise IGA platform for lifecycle management, access certifications, and automated provisioning
Saviynt Enterprise Identity Cloud: Cloud-native IGA with identity warehouse, access governance, and application access management
Microsoft Entra ID Governance: Identity governance capabilities including lifecycle workflows, access reviews, and entitlement management
One Identity Manager: IGA solution with business role management, attestation, and IT shop for access requests
Common Scenarios
Scenario: Building JML Process for 10,000-Employee Organization
Context: Rapidly growing company has no automated identity lifecycle. IT manually creates accounts, taking 3-5 days for new hires. Terminated employees retain access for weeks. Audit found 2,300 orphaned accounts across 45 applications.
Approach:
Integrate Workday as authoritative source with daily delta sync to IGA platform
Mine existing access patterns to define birthright roles for the top 20 job codes (covering 80% of employees)
Implement pre-hire provisioning triggered 7 days before start date for AD, email, and birthright apps
Build termination workflow that disables all access within 1 hour of HR status change
Create mover workflow that recalculates roles when job code or department changes
Deploy self-service access request portal with risk-based approval chains
Run orphaned account detection to identify and remediate the 2,300 existing orphans
Schedule quarterly access certifications to prevent access accumulation
Pitfalls:
Not defining a single authoritative source leads to conflicting identity data from multiple HR systems
Mining roles without business validation creates technical roles that do not align with organizational structure
Automating termination without grace period for knowledge transfer frustrates business managers
Not handling contractor and vendor identities that exist outside the HR system
Output Format
IDENTITY GOVERNANCE LIFECYCLE REPORT
=======================================
Authoritative Source: Workday
IGA Platform: SailPoint IdentityIQ
Total Identities: 10,247
Active Employees: 9,834
Contractors: 413
LIFECYCLE AUTOMATION
Joiner (Pre-Hire) SLA: Target: 0 days | Actual: 0.2 days avg
Mover Processing SLA: Target: 1 day | Actual: 0.8 days avg
Leaver Disablement SLA: Target: 1 hour | Actual: 0.5 hours avg
PROVISIONING METRICS (Last 30 Days)
New Hires Provisioned: 187
Auto-Provisioned: 174 (93.0%)
Manual Intervention: 13 (7.0%)
Role Changes Processed: 89
Terminations Processed: 43
Within 1-Hour SLA: 41 (95.3%)
ROLE GOVERNANCE
Defined Roles: 127
Birthright Roles: 48
Average Entitlements/Role: 12.3
Role Overlap > 70%: 8 pairs (consolidation recommended)
ORPHANED ACCOUNTS
Detected: 23
Critical: 2 (privileged accounts)
High: 8
Medium: 13
Remediated (30 days): 19
Outstanding: 4
ACCESS REQUESTS
Submitted: 342
Auto-Approved (Birthright):87 (25.4%)
Approved: 231 (67.5%)
Denied: 24 (7.0%)
Average Approval Time: 6.2 hours
SOD Violations Flagged: 12
