Account Lifecycle · Departed-Employee Account Revocation
Account Lifecycle Management (Joiner-Mover-Leaver)
What is the account lifecycle?
- Based on three events: joining, moving, leaving
- Revoking old permissions is the step most often skipped when someone changes roles
- HR and IT check together on the last working day
Managing the account lifecycle lets you answer one question: “Can someone who has left the company still log in?” Accounts issued at hiring don’t disappear when a person leaves. Email, groupware, cloud storage, and the SaaS tools individual departments adopted on their own add up: at many companies, a single person has more than ten doors open, and neither HR nor IT knows about some of them. Because one account a former employee can still access is a data leak waiting to happen, this process is where security starts.
The lifecycle has three phases. Joiner: the account and basic permissions are issued in time for the first day of work. Mover: permissions from the previous department are withdrawn and new ones granted. Leaver: access is cut off on the last day of work, and the account is deleted after a set period once materials have been handed over. Movers are the phase most often missed. If permissions only accumulate through promotions or transfers, you end up with one person who can see the sales, finance, and HR systems all at once. During the December–January promotion and reassignment season, it is important to withdraw existing permissions before granting new ones.
The core of the practice is linking HR events to account actions. Ideally, entering a departure date in the HR system automatically sends a revocation request to IT, and tools connected to single sign-on (SSO) with unified authentication are cut off in one step. If your company isn’t there yet, you need at least an account list in the offboarding checklist and one line for HR to confirm with IT on the last working day. Preserving email after departure, handing over work files, and changing shared-account passwords should also be handled the same day, and accounts for contractors and contract workers are missed more often than those of permanent staff, so they need a separate list.
The most common slip in practice is treating “offboarding done” as blocking a single email account. Accounts for survey, design, and AI tools that a department adopted on its own stay active, and former employees can still log in months later. The opposite mistake is also common: cutting access before the last working day, so the employee leaves without handing over their materials. When departures cluster at year-end, one IT person processing dozens of accounts by hand is bound to miss some, so a joint HR-IT check during that period is the safer approach. Removing departed employees’ accounts is the first thing security audits and certification reviews check.
Seolyeong ParkGenerative AI and AX training expert with 17 years of hands-on experience and 200+ sessions, making AI usable right away even for non-specialists
Seungtae ParkPractical AX instructor who teaches by building AI business development and marketing automation hands-onIn identity and access management (IAM) practice, the framework of handling accounts around three events in a person’s tenure (joining, moving, and leaving) became known as “Joiner-Mover-Leaver.” As cloud tools multiplied and the number of accounts each person uses surged, removing departed employees’ accounts became a basic item in security audits.
Consider a hypothetical case. Company A, an education content company with 390 employees, had 14 departures last December. Three of those employees’ design-tool accounts were still active the following March, and a security audit found a log showing one of them accessing a shared folder after leaving. The CEO demanded a prevention plan before the end of this year.
- When an HR associate and the IT team counted accounts per employee together, the average was 13, and 5 of those were for tools that departments had contracted separately and that were not on the IT team’s list.
- They added two lines to the offboarding checklist, “full list of accounts held” and “IT team revocation sign-off,” and changed the groupware settings so that an automatic email goes to the IT team as soon as HR enters the departure date.
- Nine tools that could be connected to SSO were linked so that a single offboarding action cuts off access. For the four tools that couldn’t be connected, each department owner revokes access on the last working day and reports back to Assistant Manager Han.
- For the 42 January promotions and transfers, the team applied the rule of “revoke existing permissions before granting new ones.” When the sales director asked to keep viewing the previous department’s materials for one more month, they granted a 30-day, view-only permission instead.
- For the 11 employees who left this December, the account removal rate as of their last working day was 100%, and the following year’s security audit found 0 leftover accounts for departed employees.