Operating guide · Identity
Rebuilding joiner, mover and leaver controls
An identity-lifecycle design connecting approvals, applications, devices and completion records.
Gaps to close
- Provide access quickly without copying excess privilege
- Remove access consistently during role changes and exits
- Reduce licence waste
- Create evidence without adding a heavy workflow
Decisions to settle
- Authoritative people source
- Role owners and exception approval
- Urgent termination channel
- Automation boundaries and failure handling
How to know it is working
- Test joiner receives only approved role access
- Test mover loses incompatible previous access
- Test leaver sessions and application access are removed
- Periodic reconciliation finds seeded discrepancies
Working documents
- Lifecycle workflow
- Role and application matrix
- Urgent termination card
- Application-owner register
- Reconciliation report template
Putting the routine in place
- 01
Process and access map
Map triggers, approvers, role templates, systems, devices, data and urgent termination requirements.
- 02
Minimum viable workflow
Create one controlled request, approval and completion record with role templates and exceptions.
- 03
Application coverage
Extend beyond Microsoft 365 to software-as-a-service applications, shared secrets, delegated access, physical assets and third parties.
- 04
Reconciliation
Compare people, identities, licences, guests and privilege regularly and report unresolved exceptions.