How Does SailPoint Automate Joiner, Mover and Leaver Access Management?
-
Access should follow the individual, not the form. When someone enters, transfers, or exits, access must change fast. If manual, this seldom occurs. Backlogs occur, newly onboarded people have to wait days to receive applications, and outdated accounts remain operational even after leaving the office. And there’s your security problem right there. I’ve had some teams try spreadsheets for that job, and let me tell you, it doesn’t turn out well.
The first session anyone takes at SailPoint Training will reveal to them that this problem is solved through this platform via the linkage of identity information to access management. The system looks at changes in employee data, compares them with policies and makes updates to access as needed. Here, this article discusses the mechanics for joiner, mover, and leaver situations.
Employee Changes That Trigger Access Updates
Every access change begins with an event affecting the individual. There are three such events which require distinct responses.
Identity Data Drives Every Decision
The system creates one identity per person by taking information from such sources as human resources information systems. This identity contains attributes such as position, department, manager, and location. Any change in the attribute gets noticed instantly, and the system looks at its policy and access control to see what needs to be done about the user's accounts. There is no guesswork. The data defines the person, and the policy defines his or her access.
Joiner: Access Ready on Day One
The joiner flow is simple to follow:
- Employee record is created
- Identity is established
- Role and attributes are evaluated
- Required access is identified
- Accounts and permissions are provisioned
For example, the instance of hiring a new financial analyst. Even before commencing work, his email, shared drives, and reporting have all been set up. There is no need for the administrator to create the process from scratch. They only step in for exceptions. The new hire starts working that same morning, not three days later.
Mover: Adjust, Don't Just Add
A mover is trickier than a joiner. Granting new permissions is easy. Removing the old ones is what people forget, and that leads to "access creep," where someone quietly collects rights over the years.
Mover flow is as follows: Role changes, attributes change, old access is reassessed, new access is granted, and anything superfluous is stripped away. A person being moved from sales to finance shouldn't maintain customer-pricing rights. That's the entire purpose.
Leaver: Slamming the Door Shut Fast
Once the individual is classified as an ex-employee by the HR department, the lifecycle event is recorded by the system. The system will then search for all accounts associated with the individual. Access is revoked according to the policy.
- Manual offboarding can take days
- Automated offboarding often takes minutes
- Fewer forgotten logins mean fewer windows opened.
The smaller the window, the less chance that an employee will take with them.
Policies Ensure Automation Consistency
There can be no automation without policies. All changes happen through organisational sense instead. These are the basics:
Role-based Access Control: A group of permissions that is associated with the function of the job
Policies: This includes separation of duties, whereby an individual is not allowed to authorise and process payments for the same invoice.
Identity attributes: the data that triggers decisions
Approvals: a manager or owner signs off on sensitive requests
Governance rules: reviews that confirm access still makes sense
Any candidate preparing for the SailPoint certification should be conversant with these terms since they tend to ask about these in the examination.A Complete Joiner-to-Leaver Lifecycle
Let's follow one person, Maya, through the whole thing.
- Maya joins as a marketing executive and receives role-based access automatically.
- Two years later, she moves to product management.
- Her attributes update, and the system reassesses her access.
- Marketing tools are removed, and product tools are added.
- Maya resigns, and HR updates her status.
- All her accounts are disabled the same day.
The administrator never kept a manual check on her history at any stage. In many practical laboratories, such as the case of SailPoint Training in Noida, they tend to use the exact same example to show the complete process cycle.
Conclusion
Changes in the information related to the employee take place. The system is triggered, and depending on rules, permissions are created, modified or even revoked. It is the entire process. It ensures that permissions remain relevant with regard to the current role of the employee rather than past records. Once you understand this process well, joining, moving, and leaving become one process cycle.