From joiner to leaver: Automating user lifecycle management

On paper, someone moving from sales to finance might look like a simple role change. But for IT, it means a shift in access that spans multiple systems. Access to a new set of apps must be granted while old permissions need to be removed. Some access needs approval or time limits. And months later, someone may need to know who approved that access and why it was granted.

That's the everyday reality of user lifecycle management. People join companies, change roles, take on temporary responsibilities, and eventually leave. Their access has to keep up with each change, but the systems used to manage those updates often sit in different places.

A request might start in the help desk, get approved in Slack, and require someone to make the change in a separate admin platform. With that much fragmentation, automating the joiner-mover-leaver (JML) framework is harder than it should be.

Serval closes that gap. It’s an AI-native ITSM platform built to turn approved requests into real access changes without sending IT into separate admin consoles. It pairs workflow automation and access management in one place, which makes lifecycle changes easier to execute.

This guide shows how bringing access management and workflow automation into the same platform as the help desk makes it easier to automate the user lifecycle.

Why user lifecycle management gets harder (and more important) at scale

User lifecycle management (also known as identity lifecycle management or account lifecycle management) is the process of managing accounts and permissions as someone’s relationship with a company changes. It starts when they join, continues through role changes or transfers, and ends when they leave.

User lifecycle management isn’t synonymous with identity and access management (IAM). IAM covers how people authenticate and access systems through tools like SSO and MFA. User lifecycle management has a narrower focus: It keeps the accounts and permissions behind that access current as employees move through the company.

Keeping those changes in sync can be challenging. Every transition can touch multiple user accounts and permissions across a growing SaaS stack. And when those changes depend on manual provisioning and deprovisioning, it’s easy for access to lag behind reality, especially as your company grows.

The bigger the organization, the more moving pieces there are. More employees means more hires, departures, and internal moves. More apps means more places where access needs updating. And more specialized roles make it harder to know what someone should still have access to when their job changes.

The same lifecycle problem applies to non-human identities. Service accounts and API keys can become difficult to track as systems evolve.

Joiner, mover, leaver: The 3 stages of user lifecycle management

Each stage of the user lifecycle creates a different access management problem for IT. Joiners need the right access provisioned from the start. Movers need access adjusted without old permissions following them into a new role. And leavers need access removed completely and on time.

Here’s what managing each JML stage looks like in practice.

Joiner: Onboarding and initial provisioning

The joiner stage starts before an employee logs in for the first time. IT needs to create their accounts and provision the right access based on their role.

At a small company, employee onboarding might mean working through a checklist by hand. That gets harder as the company grows because two people with the same job title won't necessarily need the same setup. Their department or location can change which apps they need and what hardware they receive.

With Serval's Journeys, an event in the HRIS can kick off a multi-step onboarding process that provisions accounts and access based on information like role or department. Tasks can depend on one another too. IT can define the process once instead of rebuilding the onboarding checklist for every new hire.

Mover: Role changes, transfers, and temporary access

Access lifecycle management becomes more complex at the mover stage. When someone changes roles, the job isn't simply to give them more access. IT also has to determine what they should lose.

Say someone moves from sales into finance. Their new role might require access to financial systems while their old CRM permissions should be revoked. IT may also have to handle temporary access in some areas. An employee might need elevated permissions for a project without needing that privilege indefinitely.

Serval uses just-in-time (JIT) provisioning to make time-bound access expire automatically instead of relying on someone to remember to revoke it later. Employees can also submit access requests through the help desk. From there, workflow approvals route the request to the right approver before provisioning happens.

Role changes can work in the other direction too. An HRIS update can trigger a workflow that removes access tied to the employee's previous role. This keeps privileges aligned with current responsibilities instead of letting old permissions pile up over time.

Leaver: Offboarding and deprovisioning

Employee offboarding is the point where access needs to be removed rather than adjusted. Once someone leaves the company, IT has to deactivate their accounts and revoke their permissions across every system they used.

That process can be harder than it sounds. Access accumulates over time, especially for employees who’ve changed roles or taken on temporary responsibilities. If offboarding depends on someone manually working their way through a checklist, it’s easy for an account or permission to get missed.

Serval uses journeys and access management to coordinate deprovisioning across connected systems. A departure can trigger workflows that revoke access automatically. Each action is recorded, giving IT an audit trail of what was removed and when.

Why user lifecycle management belongs inside your ITSM platform

Automating each stage of the user lifecycle solves part of the problem. But where that automation lives matters too.

The problem with treating user lifecycle management software as a separate layer is that much of the work it needs to act on already shows up elsewhere. Employees submit access requests through the help desk, and that’s where managers approve them. Information about who’s joining, changing roles, or leaving sits in the HRIS. When provisioning runs in a separate identity governance (IGA) tool, IT maintains two highly privileged integrations with the source system, one for the IGA tool and one for the ITSM. With Serval, you need one.

Bringing access management and workflow automation into the ITSM platform closes that gap:

• Requests can become actions: An approved request can trigger a workflow that provisions or revokes access instead of creating another task for IT.
• IT keeps control over execution: In Serval, employees interact with the help desk agent while admins build workflows separately. The agent can run approved workflows while API keys and endpoints remain fully managed by IT.
• The history stays with the request: Approvals and workflow actions are captured in audit trails, letting IT see how access changed without needing to piece together records from separate systems.

That’s the difference between routing an access ticket and automating it. Routing gets the request to the right person faster. Automation carries the approved request through provisioning or deprovisioning and resolves it end to end.

How Serval automates the full user lifecycle

So how do you automate user lifecycle management without building a separate system for every stage? Start by turning the repeatable work at each stage into workflows that can run when someone joins, changes roles, or leaves.

Serval’s Catalyst helps IT teams build those automations. Admins can describe what they want in natural language. Catalyst then builds the workflows, journeys, and access management setup needed to carry out the work.

The bigger advantage is what happens after those automations are built. The same platform that receives an access request can approve it and carry out the change. A role change can update access instead of creating another task for IT. And offboarding can end with access actually revoked instead of just marking a ticket complete.

Ready to automate the user lifecycle? Book a Serval demo today.

FAQ

What happens when user offboarding is incomplete?

Incomplete offboarding leaves behind active accounts or permissions after someone has left the company. These orphaned accounts create unnecessary access and make it harder for IT to maintain least privilege. Automating deprovisioning helps ensure access is revoked across connected systems instead of relying on someone to check every account manually.

Does automating user lifecycle management require replacing your existing ITSM platform?

Not necessarily. Serval can work alongside an existing ITSM rather than requiring a complete replacement. The bigger question is where the lifecycle automation happens. Keeping access management and workflow automation close to the help desk reduces the handoffs between where requests originate and where access actually gets changed.

How often should user access be reviewed to prevent privilege creep?

There isn’t one review schedule that makes sense for every organization. The right cadence depends on factors like the sensitivity of the access and your compliance requirements. Higher-risk or privileged access may warrant more frequent review. Serval’s user access reviews cover every account and role grant in scope, not only access that changed at a joiner, mover, or leaver event.