Joiners, movers and leavers: control over access rights and assets with every personnel change

Joiners, movers and leavers: control over access rights and assets with every personnel change

A new employee joins the organisation. HR records their details, accounts are created, access rights are assigned and the necessary equipment is requested. Everything needs to be ready on their first working day.

When an employee leaves, the reverse happens: permissions must be revoked and company assets returned. Between joining and leaving, however, there is another equally important moment: an employee changes role, department or responsibility.

That is when the quality of the Identity & User Management process (IDU) really becomes apparent.

An employee is more than an account

IDU often focuses on digital access. Which applications does someone need, and which data may they access?

In practice, there is more to it. A role may also involve a laptop, phone, access badge, specific applications, licences, shared mailboxes or other company assets.

The starting question should therefore not be: which permissions do we need to add?

The better question is: what does this employee need, based on their role, to do their work?

This means considering the employee's complete profile: both permissions and assets.

Onboarding: start with a profile

When a new employee is registered, their department, role, location and other details are often already known.

That information can be the starting point for the IDU process. A profile can determine which permissions and assets normally belong to the role.

A Finance employee needs different resources from someone in Sales or IT. The same applies to a healthcare worker, teacher or municipal employee.

Working with profiles means you do not have to work out the requirements again for every new employee. Exceptions remain possible, but the standard is clear and manageable.

Role changes: the overlooked risk

A change of role is often more complicated than onboarding.

Suppose someone moves from role A to role B. The new role profile requires different applications, permissions and possibly different assets.

Granting new permissions is usually not the main problem. The key question is: which old permissions are no longer needed?

If permissions are only added, they accumulate throughout a person's employment. An employee may retain access to information or systems that are no longer relevant to their current role.

The same applies to assets. The new role may require a different type of device, phone, access badge or licence.

A role change should therefore be a controlled transition from one profile to another, rather than an isolated update.

Offboarding: has everything actually been closed?

When someone leaves, the process seems clear: block accounts, revoke permissions and request the return of equipment.

Yet this is precisely where several departments and systems are involved. HR knows the end date, IT manages accounts and devices, facilities may manage badges and other assets, and application owners may be responsible for specific access rights.

Closing an account does not automatically mean that the entire offboarding process is complete.

Has the laptop been returned? Has the access badge been blocked? Have licences been released? Have additional permissions been revoked? Are company assets available for reuse?

Only when the entire process chain has been checked is offboarding truly complete.

Service Automation Suite as the orchestration layer over the IDU process

In many organisations, HR, Identity & Access Management, device management, service management and other environments are already connected. Employees are still needed, however, to check whether every step has actually been carried out.

This is where Service Automation Suite comes in.

Service Automation Suite can orchestrate the process across different systems and departments. An HR change can, for example, trigger a comparison between the existing profile and the new profile, followed by orchestration and monitoring of the required actions.

This is not just about adding things, but also about changing and removing them.

Integration connects systems. Orchestration provides control.

From individual permissions to lifecycle control

A well-configured IDU process follows the employee throughout their employment:

Join → assign a profile → provide permissions and assets → process role changes → update the profile → revoke old permissions and reclaim assets → leave → verify complete closure.

This improves efficiency while providing better control over security, continuity and governance.

The important question is therefore not just whether your IDU process is automated.

The question is: can you demonstrate, for every employee, that their current permissions and assets still match their current role?

With a Service Automation Suite Assessment we map out the complete IDU process, from HR changes to permissions, profiles and company assets. This reveals where manual checks, exceptions and risks remain, and where orchestration can provide greater control.

Want to know more? Book a Service Automation Suite Assessment below.

Contact us for more information or the accompanying document.