# Joiner-Mover-Leaver Procedure Template

Source: https://startwithidentity.com/templates/joiner-mover-leaver-procedure/
Last updated: 2026-11-05
License: content by Start with Identity. Cite the source URL.

---

A joiner-mover-leaver (JML) procedure is the documented sequence that creates access when someone starts, changes it when they move role, and removes it when they leave, with a time limit for each step and a record that proves it happened. Auditors test JML by sampling: they pick leavers from the HR system and check when each one lost access in each system. This template gives you the steps, an SLA table to fill, and the evidence to keep so the sample passes.

## How to use this template

1. Confirm the trigger: every JML event should start from the HR system of record (or the contractor sponsor's request), not from an email to IT.
2. Fill the SLA table (section 2). The bracketed values are suggested starting points used by many teams; they are planning estimates, not requirements from any standard. NIST AC-2 and PS-4 ask you to *define* the time periods; they do not set them.
3. List every system that is *not* connected to automated provisioning in section 6. Those are the ones that fail audits.
4. Adopt it under your [IAM policy](https://startwithidentity.com/templates/identity-and-access-management-policy/), section 4.2.

Background: [joiner-mover-leaver](https://startwithidentity.com/glossary/joiner-mover-leaver/), [user lifecycle management guide](https://startwithidentity.com/guides/implementation/user-lifecycle-management-guide/), [SCIM provisioning recipe](https://startwithidentity.com/recipes/set-up-scim-provisioning/).

**Owner:** `[Identity team]` | **HR contact:** `[ ]` | **Approved:** `[date]`

## 1. Triggers and sources

| Event | Source of truth | Trigger | Who is notified |
|-------|----------------|---------|-----------------|
| Joiner (employee) | `[HRIS]` | Hire record reaches `[status]` | Manager, identity team |
| Joiner (contractor) | `[Sponsor request / VMS]` | Approved request with end date | Sponsor, identity team |
| Mover | `[HRIS]` | Change of department, manager, job code or location | Old and new manager |
| Leaver (voluntary) | `[HRIS]` | Termination date entered | Manager, identity team |
| Leaver (involuntary) | `[HR business partner]` | Direct notice to identity team before the conversation | Identity team on-call, security |
| Contractor end | `[Sponsor / VMS]` | End date reached or sponsor ends engagement | Sponsor |

*(NIST AC-2(l) Align account management processes with personnel termination and transfer processes; AC-2(h) notify account managers when users are terminated or transferred)*

## 2. SLA table

| Event | Step | SLA | Measured from | Measured to |
|-------|------|-----|---------------|-------------|
| Joiner | Birthright access ready | `[Before start date]` | HR record created | First successful sign-in possible |
| Joiner | Additional access | `[2 business days]` | Approved request | Access granted |
| Mover | New role access | `[1 business day]` | HR change effective | New birthright applied |
| Mover | Old role access removed | `[5 business days]` | HR change effective | Old entitlements removed and verified |
| Leaver (standard) | Disable IdP account and end sessions | `[End of last working day]` | Termination time | Account disabled, sessions revoked |
| Leaver (standard) | Remove access in non-federated systems | `[24 hours]` | Termination time | Confirmed by system owner |
| Leaver (involuntary or privileged) | Disable all access | `[Immediately, before or during notification]` | HR notice | Account disabled, sessions and tokens revoked |
| Contractor end | Disable all access | `[At end date, automatic]` | End date | Account disabled |
| Any | Inactive account disabled | `[__ days]` without sign-in | Last sign-in | Account disabled |

*(NIST PS-4(a) disable system access within an organization-defined period; PS-5 initiate and complete transfer actions within defined periods; AC-2(3) Disable Accounts)*

## 3. Joiner procedure

- [ ] HR record created with job code, department, manager, location and start date.
- [ ] IdP account created automatically from the HR record. Unique identifier assigned and never reused. *(NIST IA-4 Identifier Management)*
- [ ] Birthright groups assigned from the [role catalog](https://startwithidentity.com/glossary/rbac/) for the job code.
- [ ] Downstream accounts created by [SCIM](https://startwithidentity.com/glossary/scim/) or JIT provisioning from the IdP.
- [ ] Enrollment credential issued (for example a temporary access pass) only after identity is verified, following the [MFA standard](https://startwithidentity.com/templates/mfa-authentication-standard/).
- [ ] User registers phishing-resistant MFA on day one.
- [ ] Any access beyond birthright is requested and approved by the system owner. *(NIST AC-2(e) approvals for account creation)*
- [ ] Contractor accounts are created with an end date and a sponsor ([third-party access policy](https://startwithidentity.com/templates/third-party-contractor-access-policy/)).

## 4. Mover procedure

- [ ] HR change triggers recalculation of birthright groups.
- [ ] New birthright access is added.
- [ ] Old manager and new manager are asked to confirm which non-birthright access the person still needs. Default is removal.
- [ ] Access not confirmed is removed within the SLA and the removal verified in the target system. *(NIST PS-5(a), PS-5(c); ISO 5.18 Access rights)*
- [ ] Privileged access is re-approved, never carried over automatically.
- [ ] Ownership of service accounts and other NHIs held by the person is confirmed or reassigned.

> Guidance: movers are where entitlements pile up. An access review that never revokes anything usually means mover cleanup is not happening; see [mover entitlement accumulation](https://startwithidentity.com/techniques/mover-entitlement-accumulation/).

## 5. Leaver procedure

- [ ] Disable the IdP account (do not delete yet).
- [ ] Revoke active sessions and refresh tokens in the IdP and in major SaaS apps that keep their own sessions.
- [ ] Revoke personal API tokens, SSH keys, OAuth grants and app passwords the person created. *(NIST PS-4(b) terminate or revoke authenticators and credentials)*
- [ ] Remove the person from privileged roles and vault access; rotate any shared credentials they could see. *(NIST AC-2(k))*
- [ ] Reassign ownership of NHIs, integrations, shared drives and calendars before removal.
- [ ] Remove MFA methods and device registrations; wipe or retire company devices.
- [ ] Disable accounts in every system not connected to the IdP (section 6) and record confirmation.
- [ ] Recover hardware (laptop, security keys, badges). *(NIST PS-4(d))*
- [ ] Keep data the organization needs; transfer mailbox and files per `[retention policy]`. *(NIST PS-4(e))*
- [ ] Delete the account after `[30 / 90]` days.

Use the [secure offboarding checklist](https://startwithidentity.com/templates/secure-offboarding-checklist/) for the full leaver run.

> Guidance: disabling SSO does not end a session or a token that already exists. At [CrowdSec](https://startwithidentity.com/breaches/incidents/2026-crowdsec-departing-engineer-github-token/), a former employee's GitHub account was left open to finish work and its valid token was used to copy private repositories. At [Cash App Investing](https://startwithidentity.com/breaches/incidents/2022-cash-app-former-employee/), a former employee downloaded customer reports after leaving. See [orphaned account abuse](https://startwithidentity.com/techniques/orphaned-account-abuse/).

## 6. Systems outside automated provisioning

| System | Owner | How access is removed | Who confirms | SLA |
|--------|-------|-----------------------|--------------|-----|
| `[ ]` | `[ ]` | `[manual ticket / script]` | `[ ]` | `[ ]` |

## 7. Evidence to keep

| Event | Evidence | Where it lives | Retention |
|-------|----------|----------------|-----------|
| Joiner | HR record, access request with approver and timestamp, provisioning log | `[ ]` | `[__ years]` |
| Mover | HR change record, manager confirmations, removal log with timestamps, verification that old access is gone | `[ ]` | `[__ years]` |
| Leaver | HR termination timestamp, IdP disable timestamp, session revocation log, per-system confirmation for non-federated apps, device return record | `[ ]` | `[__ years]` |
| Exceptions | Late removals with reason and approver | `[ ]` | `[__ years]` |
| Metrics | Monthly SLA report | `[ ]` | `[__ years]` |

> Guidance: the auditor's question for each sampled leaver is "termination time vs. disable time, per system". Keep both timestamps in UTC in one place and the sample takes minutes instead of days.

## 8. Metrics

| Metric | Target | Last month |
|--------|--------|-----------|
| Leavers disabled within SLA | 100% | `[ ]` |
| Median time from termination to IdP disable | `[ ]` | `[ ]` |
| Movers with old access removed within SLA | `[ ]%` | `[ ]` |
| Active accounts with no matching HR record | 0 | `[ ]` |
| Accounts disabled for inactivity | `[ ]` | `[ ]` |

## Control mapping

| Step | NIST SP 800-53 Rev. 5 | ISO/IEC 27001:2022 Annex A |
|------|-----------------------|----------------------------|
| Triggers | AC-2(h), AC-2(l) | 5.16 Identity management |
| Joiner | AC-2(e), IA-4 | 5.16; 5.18 Access rights |
| Mover | PS-5 Personnel Transfer | 5.18; 6.5 Responsibilities after termination or change of employment |
| Leaver | PS-4 Personnel Termination; AC-2(k) | 5.18; 6.5; 5.11 Return of assets |
| Inactivity | AC-2(3) Disable Accounts | 5.18 |
| Third parties | PS-7 External Personnel Security | 5.19 Information security in supplier relationships |

Control text: [NIST SP 800-53 Rev. 5 catalog](https://csrc.nist.gov/projects/cprt/catalog#/cprt/framework/version/SP_800_53_5_2_0/home). ISO/IEC 27001:2022 is available from [ISO](https://www.iso.org/standard/27001).

## Related

- [Access review checklist](https://startwithidentity.com/templates/access-review-checklist/)
- [What is IGA](https://startwithidentity.com/guides/fundamentals/what-is-iga/) and [how to choose an IGA platform](https://startwithidentity.com/guides/buyer-guides/how-to-choose-an-iga-platform/)
- [Deprovisioning](https://startwithidentity.com/glossary/deprovisioning/) and [orphaned account](https://startwithidentity.com/glossary/orphaned-account/)
- [SOC 2 for identity](https://startwithidentity.com/guides/compliance/soc2-for-identity/) (CC6.2 is the joiner and leaver criterion)