A structured reference guide and portfolio project on User Lifecycle Management (ULM) — the identity and access governance process covering onboarding, role changes, and offboarding across an organization. Includes process design, IAM tooling considerations, risk analysis, compliance mapping, and sample artifacts.
Modeled against a fictional Canadian fintech, Meridian Trust Financial, for realistic, scenario-based context.
Author: Paul Tunde Hamzat Topic area: IAM · Access Governance · GRC
User Lifecycle Management (also called Joiner-Mover-Leaver, or JML) is one of the most consistently audited controls in any organization — and one of the most common sources of findings. Orphaned accounts, delayed offboarding, and unreviewed access are recurring themes in SOC 2, ISO 27001, and PCI-DSS audits, and are a favorite target in penetration tests and real-world breaches alike. Getting JML right is core GRC and IAM practice: it touches HR systems, ticketing, identity providers, and every downstream application an employee ever touches.
| # | Document | Summary |
|---|---|---|
| 1 | Foundations | What ULM/JML is and why it's a foundational access control |
| 2 | Governance & Policy | RBAC, least privilege, policy ownership, and approval chains |
| 3 | Joiner — Onboarding | Provisioning new hires: accounts, roles, baseline access |
| 4 | Mover — Role Change | Handling transfers, promotions, and access recertification |
| 5 | Leaver — Offboarding | Timely deprovisioning, termination workflows, and evidence retention |
| 6 | Access Reviews & Recertification | Periodic reviews, attestation, and manager sign-off |
| 7 | Automation & IAM Tooling | HR-to-IdP integration, SCIM, JML automation patterns |
| 8 | Risks & Challenges | Orphaned accounts, privilege creep, offboarding delays |
| 9 | Compliance Mapping | ISO 27001, NIST 800-53, SOC 2, PCI-DSS control alignment |
| 10 | Metrics & KPIs | Time-to-provision, time-to-deprovision, review completion rate |
| 11 | Strategic Recommendation | Target-state JML architecture and maturity roadmap |
| — | References | Standards and frameworks cited throughout |
| Artifact | Description |
|---|---|
| JML SOP Checklist | Step-by-step standard operating procedure for each lifecycle stage |
| Access Request Ticket (sample) | Example ticket showing a role-change access request and approval trail |
| Offboarding Checklist | Deprovisioning checklist used at termination |
| Quarterly Access Review Log (sample) | Sample recertification tracking sheet |
flowchart LR
HR[HR System<br/>Workday/BambooHR] -->|new hire event| Joiner[Joiner:<br/>Provision Access]
HR -->|role change event| Mover[Mover:<br/>Recertify Access]
HR -->|termination event| Leaver[Leaver:<br/>Deprovision Access]
Joiner --> IdP[Identity Provider<br/>Azure AD / Okta]
Mover --> IdP
Leaver --> IdP
IdP --> Apps[Downstream Applications<br/>& Systems]
The core principle: identity events in HR should drive access changes automatically and promptly — manual, ticket-only processes are where JML controls break down.
Most JML failures aren't a policy problem — they're an automation and ownership problem. See Strategic Recommendation for the target-state architecture that closes the gap between HR events and actual access changes.
Content shared for educational and portfolio purposes. See LICENSE.