A change of role: do access rights change too?

An employee changes roles. Do access rights change too?

An employee moves from Finance to Sales. The new account does not need to be created, as it already exists. The new permissions are requested and, after a short period, the employee can start working.

Are the old Finance permissions also revoked?

The middle phase of employee movement — the transition — is often harder to manage than onboarding or offboarding. Attention is mainly focused on what someone needs in their new role. What they no longer need tends to receive less attention.

Access accumulates gradually

A role change may seem simple, but it can affect multiple systems and responsibilities. HR records the new role, IT adjusts groups, and application administrators manage specific access rights.
When this is not managed as a single process, a simple addition of rights can easily occur.

An employee receives new access, while part of the old access remains active. The same happens in a subsequent role change. This is also known as access accumulation in the literature.
This is not just a security issue. It is primarily a process management issue. Who decides which access should be removed? Who ensures that this actually happens? And where is visibility that all steps have been completed?

HR knows the change; other systems must follow

The source of a role change often lies in HR. There, it is known that an employee is taking on a different role, department, or manager.
But that change has implications beyond the HR system.

Think about groups, applications, roles, permissions, and other provisions. The manual handover and processing of all these changes makes the process dependent on people and local workflows.
It's not just about speed. An employee who gains access to a new application a day later is frustrating. Old access rights that remain active for months are much less visible.

Until someone runs into trouble during a review.

IDU calls for end-to-end control over the entire lifecycle

Within the Service Automation Suite platform we therefore do not only look at the automatic creation and deletion of accounts.

Onboarding, role changes, and offboarding form one complete lifecycle. A change in HR can be the starting point for actions that then need to take place across different systems.
Service Automation Suite takes control of the process. Existing systems remain responsible for their own functions, while from the central process layer, it is decided which steps must take place and whether they have actually been executed.

This makes the role changes phase particularly important. It's not just about granting new rights, but also about systematically verifying which existing access no longer fits the new situation.

The question is not just: what needs to be added?

When an employee changes roles, the process often starts with the question: What does this employee need now?

For good process control, a second question should follow:

What does this employee no longer need now?

This combination helps prevent access rights from piling up during an employment period.

A well-structured IDU process therefore goes beyond simply creating accounts faster. It ensures that changes can be monitored throughout the entire employment period.
And this provides IT with greater visibility, while also reducing dependence on manual controls and individual administrator knowledge.

How do you manage employee role changes?

Onboarding and offboarding are often reasonably well structured. The interesting question is what happens in the years in between.

With a Service Automation Suite Assessment we can map out the current IDU process and identify where manual steps, dependencies, and risks around authorisations arise.

Want to learn more about access rights during role changes?

Do you want to know how to prevent access rights from accumulating during role changes? Leave your details below. We will contact you to discuss how you can gain better control over onboarding, role changes, and offboarding, and the management of access rights within your organisation.

Contact us for more information or the accompanying document.