Onboarding and offboarding are where most access mistakes happen. Joiner-mover-leaver (JML) controls do not need to be complex, but they do need to be consistent. A few repeatable steps will prevent most access sprawl and reduce incident risk.

This guide outlines a practical JML workflow for technical teams.

1. Define the source of truth

JML only works when identity is centralized.

Practical steps:

  • Use a single IdP as the source of truth.
  • Require SSO for core systems.
  • Eliminate local accounts where possible.

2. Standardize role templates

Standard roles reduce custom access sprawl.

Practical steps:

  • Create a small set of role templates (Engineer, Admin, Support).
  • Assign access by role, not by individual tools.
  • Review role templates quarterly.

3. Automate onboarding

Manual onboarding leads to missed steps.

Practical steps:

  • Use SCIM or directory sync for provisioning.
  • Automate group membership by role.
  • Track provisioning events in logs.

4. Enforce MFA from day one

MFA should be part of onboarding, not an afterthought.

Practical steps:

  • Require MFA for all privileged access.
  • Use phishing-resistant MFA for admins.
  • Block access until MFA is configured.

5. Keep access changes auditable

Moves and changes should leave a clear trail.

Practical steps:

  • Log role changes and approvals.
  • Track temporary access grants.
  • Review access logs monthly.

6. Offboard fast and completely

Offboarding delays are a common incident cause.

Practical steps:

  • Disable accounts the same day as exit.
  • Revoke access across cloud and SaaS tools.
  • Remove shared access tokens and keys.

7. Handle contractors and vendors

Non-employee access often drifts the most.

Practical steps:

  • Use time-boxed access for vendors.
  • Require approvals for vendor access.
  • Review vendor access quarterly.

8. Keep a short checklist

Short checklists get used. Long ones get ignored.

Checklist items:

  • Account created in IdP
  • Role assigned and documented
  • MFA enforced
  • Laptop and device policies applied
  • Access reviewed after 30 days

9. Manage devices with onboarding

Device posture should be part of access, not separate.

Practical steps:

  • Require device encryption before access.
  • Enforce OS updates within a defined window.
  • Remove device access during offboarding.

10. Track access changes during role moves

Moves often create access drift.

Practical steps:

  • Remove old role access when new roles are assigned.
  • Require approvals for elevated access.
  • Review moves monthly for drift.

11. Keep an access request log

Logs make audits and reviews easier.

Practical steps:

  • Record who requested access and why.
  • Note who approved and for how long.
  • Review the log quarterly.

12. Common JML pitfalls

These issues create long-term access risk.

Pitfalls:

  • Local accounts not tied to the IdP
  • Offboarding delays beyond one day
  • Service accounts without owners
  • Unreviewed vendor access

13. Starter plan for JML cleanup

If your JML process is inconsistent, start small.

Starter plan:

  • Inventory privileged accounts
  • Enforce MFA for admins
  • Automate onboarding for one team
  • Set same-day offboarding rules

14. Metrics to track

Metrics keep JML improvements visible.

Practical metrics:

  • Time to provision new accounts
  • Time to revoke access on exit
  • Number of privileged accounts per team

15. Validate after 30 days

Early validation catches drift before it becomes normal.

Practical steps:

  • Review new hires’ access after 30 days.
  • Remove access that is not being used.
  • Confirm MFA is still enforced.

16. Provide a short security orientation

A short orientation reduces early mistakes.

Practical steps:

  • Share the access request process and policies.
  • Explain data handling expectations.
  • Provide the security contact channel.

17. Verify offboarding completion

Offboarding is only complete when access is fully removed.

Practical steps:

  • Confirm access removal across cloud and SaaS tools.
  • Disable API keys and shared tokens.
  • Record offboarding completion in a log.

Even a short delay in offboarding can leave critical systems exposed. Same-day removal is the safest default. If the person had admin access, treat offboarding as an urgent task. Fast offboarding protects both data and operational stability. It also reduces the window for accidental access. That is a simple, measurable risk reduction. It is easy to track and report.

Quick checklist

  • Central IdP and SSO
  • Role templates defined
  • Automated onboarding workflows
  • Same-day offboarding
  • Vendor access reviewed

Closing thought

JML controls keep access under control without adding process weight. Central identity, role templates, and fast offboarding are the biggest wins.

If you want help building a JML workflow or cleaning up access drift, we can help. We focus on practical access controls that scale. Reach out through our consulting page to start a quick conversation.