Identity Lifecycle Management
Managing identities across their lifecycle (from hire to retire) is critical for security and compliance. Without proper governance, organizations accumulate orphaned accounts, excessive permissions, and access creep.
The Joiner-Mover-Leaver Process
Joiner (Onboarding)
When an employee joins:- Create accounts based on role-based templates
- Provision access to required applications
- Assign to appropriate security groups
- Issue credentials and MFA enrollment
- Document baseline access for future reviews
Mover (Role Change)
When an employee changes roles:- Review and revoke access no longer needed
- Grant access required for new role
- Update group memberships
- Recertify remaining access
- Common failure: access accumulation (old + new permissions)
Leaver (Offboarding)
When an employee departs:- Disable accounts immediately (within 1 hour)
- Revoke all access and API keys
- Transfer ownership of shared resources
- Archive mailbox and files per retention policy
- Review for suspicious pre-departure activity
Access Reviews
Quarterly Certification
- Managers review and certify their team's access
- Application owners review who has access
- Privileged access receives additional scrutiny
- Rubber-stamping detection (auto-approve patterns)
Segregation of Duties (SoD)
Prevent toxic access combinations:- Cannot approve AND process payments
- Cannot create AND approve user accounts
- Cannot modify AND audit security logs
Automation
- SCIM provisioning for cloud applications
- HR system integration for lifecycle triggers
- Automated access reviews with smart recommendations
- Orphaned account detection and cleanup
Where SuperClue Fits
SuperClue does not connect to your identity provider. Its IAM modules ask for evidence of orphaned account reviews and privilege creep controls, which is useful when you prepare for an audit.