# user-lifecycle-management

Source: https://startwithidentity.com/glossary/user-lifecycle-management/
Last updated: 2026-11-05
License: content by Start with Identity. Cite the source URL.

---

User lifecycle management is the automated creation, change and removal of a person's accounts and access as their relationship with an organization changes, driven by the [joiner-mover-leaver](https://startwithidentity.com/glossary/joiner-mover-leaver/) events in an authoritative source such as the HR system. It is a core function of [IGA](https://startwithidentity.com/glossary/iga/) and of most identity providers, and its standard transport to applications is [SCIM](https://startwithidentity.com/glossary/scim/).

[Microsoft Entra lifecycle workflows](https://learn.microsoft.com/en-us/entra/id-governance/what-are-lifecycle-workflows) are a concrete example of the three phases: a joiner "enters the scope of needing access", a mover "moves between boundaries within an organization", and a leaver "leaves the scope of needing access." Each phase triggers tasks, such as generating a first-day credential, changing group memberships or disabling the account, based on attributes like hire date or department.

| Event | Typical actions | Common failure |
|---|---|---|
| Joiner | Create accounts, assign birthright roles, issue first credential | Day-one access granted by copying a colleague's permissions |
| Mover | Add new-role access, remove old-role access | Old access never removed, see [mover entitlement accumulation](https://startwithidentity.com/techniques/mover-entitlement-accumulation/) |
| Leaver | Disable accounts, revoke sessions and tokens, reassign owned resources | Accounts in apps outside SSO and SCIM survive, becoming [orphaned accounts](https://startwithidentity.com/glossary/orphaned-account/) |

User lifecycle management is not the same as access certification: lifecycle automation acts on events as they happen, while [access certification](https://startwithidentity.com/glossary/access-certification/) periodically checks that the result is still correct. You need both, because automation only covers the apps it is connected to. In UX and product design the same phrase means the customer journey from sign-up to churn; in identity it always means accounts and entitlements.

See also: [user lifecycle management guide](https://startwithidentity.com/guides/implementation/user-lifecycle-management-guide/), [provisioning](https://startwithidentity.com/glossary/provisioning/), [deprovisioning](https://startwithidentity.com/glossary/deprovisioning/), [SCIM provisioning implementation](https://startwithidentity.com/guides/implementation/scim-provisioning-implementation-guide/), [top SCIM provisioning tools](https://startwithidentity.com/articles/top-7-scim-provisioning-tools/), [orphaned account abuse](https://startwithidentity.com/techniques/orphaned-account-abuse/)