User Lifecycle Management
User lifecycle management is the automated creation, change and removal of a person's accounts and access as their relationship with an organization changes, driven by the joiner-mover-leaver events in an authoritative source such as the HR system. It is a core function of IGA and of most identity providers, and its standard transport to applications is SCIM.
Microsoft Entra lifecycle workflows are a concrete example of the three phases: a joiner "enters the scope of needing access", a mover "moves between boundaries within an organization", and a leaver "leaves the scope of needing access." Each phase triggers tasks, such as generating a first-day credential, changing group memberships or disabling the account, based on attributes like hire date or department.
| Event | Typical actions | Common failure |
|---|---|---|
| Joiner | Create accounts, assign birthright roles, issue first credential | Day-one access granted by copying a colleague's permissions |
| Mover | Add new-role access, remove old-role access | Old access never removed, see mover entitlement accumulation |
| Leaver | Disable accounts, revoke sessions and tokens, reassign owned resources | Accounts in apps outside SSO and SCIM survive, becoming orphaned accounts |
User lifecycle management is not the same as access certification: lifecycle automation acts on events as they happen, while access certification periodically checks that the result is still correct. You need both, because automation only covers the apps it is connected to. In UX and product design the same phrase means the customer journey from sign-up to churn; in identity it always means accounts and entitlements.
See also: user lifecycle management guide, provisioning, deprovisioning, SCIM provisioning implementation, top SCIM provisioning tools, orphaned account abuse
Related on Start with Identity
- GlossaryAgent Registry
An agent registry is an inventory of the AI agents an organization runs or allows, recording for each one its identity, accountable human owner, purpose, permis
- GlossaryCIEM
Cloud Infrastructure Entitlement Management. Tools that discover and right-size identities and permissions across AWS, Azure, and GCP, reducing excessive and un
- GlossaryDirectory Service
A directory service is the system that stores an organization's identities and their attributes (users, groups, devices, service accounts) in one queryable data
- PodcastIdentity at the Center
The longest-running weekly show on identity and access management programs, hosted by two practitioners. The best single feed for keeping up with the field.
- PodcastKuppingerCole Analyst Chat
Weekly conversations between KuppingerCole analysts on identity architecture, governance, AI agents, and the market. Over 300 episodes since 2020.
- BlogMoving into IAM? Start with workforce identity and learn to trace one person's access
Most people who move into identity and access management land in workforce identity first: employees, contractors and the systems they sign in to. The fastest w