Joiner-Mover-Leaver Automation Done Right: A Practical midPoint Guide

A new employee starts on Monday. By Wednesday, they still cannot access their email, the project management tool, or the shared drive their team uses. The manager opens a helpdesk ticket. IT provisions accounts manually, copying permissions from a colleague who started two years ago and has since accumulated access to three systems they no longer need. The new hire inherits every one of those unnecessary permissions.

This is not a worst-case scenario. This is the default in most organizations. CloudEagle’s 2025 IGA report found that roughly 60% of organizations still handle provisioning and offboarding manually. Gartner’s 2024 research measured new hires losing up to 40% of first-week productivity waiting 3 to 5 days for basic access.

The leaver side is worse. 50% of ex-employees still have access to corporate applications after departure. 42% of organizations take more than a week to fully revoke access after someone leaves.

Joiner-mover-leaver automation is the single most impactful thing an IGA platform can do. It is also the capability most often botched in implementation – not because the technology is hard, but because the edge cases are underestimated. This guide covers what JML automation actually looks like in production with midPoint, including the parts that vendor demos skip.

What JML automation is and is not

JML automation connects your HR system to your IT systems so that identity lifecycle events – someone joins, changes role, or leaves – trigger automatic provisioning and deprovisioning actions across every connected application.

What it is: a policy-driven engine that translates HR data into access decisions, executes them across all target systems, and logs everything for audit.

What it is not: a one-time sync job. A spreadsheet of role mappings. A set of scripts that run on a cron schedule and break when the HR system adds a field.

The difference matters because most failed JML projects fail at the boundary between these definitions. They automate the simple path – new hire gets standard access – and leave everything else to manual process. The result is an automation layer that handles 60% of events and creates confusion for the other 40%.

The three lifecycle events in detail

Joiners

A joiner event begins when a new record appears in the HR system. In midPoint, the HR system is configured as the authoritative source – the single source of truth for identity data. When midPoint detects a new HR record, it triggers a sequence:

1. Identity creation. midPoint creates an identity object with attributes pulled from the HR record: name, employee ID, department, position, manager, start date, location.

2. Account provisioning. Based on the identity’s attributes, midPoint automatically creates accounts on target systems. A new employee in the Engineering department gets an Active Directory account, a GitLab account, and a Jira account. A new employee in Finance gets AD, the ERP system, and the financial reporting platform. These mappings are defined by organizational policies and role assignments, not by copying a colleague’s access.

3. Role assignment. midPoint assigns roles based on organizational rules. Birthright roles – the baseline access everyone in a given position needs – are assigned automatically. These are defined through policy rules that map HR attributes (department, job title, location, cost center) to midPoint roles. Each role carries specific entitlements on specific target systems.

4. Notification. The manager, the new hire, and the helpdesk are notified that provisioning is complete. The new employee has working accounts on day one.

Automated provisioning reduces onboarding time by 73% compared to manual processes. The real value is not speed alone – it is consistency. Every person in the same role gets the same access. No privilege accumulation from copied accounts. No forgotten systems.

Movers

Movers are the most underestimated JML event. A mover is any change in someone’s organizational context: department transfer, promotion, location change, reporting line change, temporary assignment, or restructuring.

The problem with movers in manual environments is privilege creep. When someone moves from Engineering to Product Management, they get new access for their new role. But their old Engineering access – repository write permissions, CI/CD pipeline access, staging environment credentials – stays. Nobody revokes it because nobody remembers to, and the employee does not report it because the access is occasionally convenient.

Over time, long-tenured employees accumulate access across multiple departments. This is one of the largest sources of segregation-of-duties violations in enterprise environments and a primary target for insider threat and lateral movement after credential compromise.

midPoint handles movers through reconciliation. When the HR system updates an employee’s department, position, or manager, midPoint re-evaluates all role assignments. Roles tied to the old organizational context are revoked. Roles tied to the new context are granted. The transition happens automatically, and the employee’s access profile always reflects their current position – not their history.

This re-evaluation runs against policy rules, not static mappings. If a policy says “everyone in Finance with the title Senior Analyst gets access to the consolidation system,” then gaining or losing the Senior Analyst title in Finance automatically grants or revokes that access. No ticket required. No manager approval needed for standard birthright access.

For access that requires explicit approval – sensitive systems, elevated privileges, cross-departmental access – midPoint routes the request through approval workflows. The mover event can trigger both automatic adjustments and approval-gated requests in the same transition.

Leavers

When an employee’s termination date is set in the HR system, midPoint begins the offboarding sequence. The timing is configurable: immediate deactivation, deactivation on the termination date, or a grace period for knowledge transfer.

1. Account deactivation. On the configured trigger date, midPoint disables all accounts across all connected systems. Not deletes – disables. The accounts remain in a suspended state for the retention period required by your compliance framework (GDPR, tax law, internal policy).

2. Access revocation. All role assignments are revoked. All entitlements are removed. The identity retains its audit history but can no longer authenticate to any system.

3. Manager notification. The leaver’s manager is notified of the deactivation and any pending access reviews or knowledge transfer requirements.

4. Delegation and reassignment. midPoint can automatically reassign ownership of resources, shared mailboxes, or service accounts that the leaver was responsible for. This prevents the orphan-account problem where a service account loses its only known owner and becomes ungoverned.

5. Archival or deletion. After the retention period, midPoint can either archive the identity record or delete it, depending on policy.

The industry benchmark for automated deprovisioning is access terminated within 15 minutes of the HR event. Organizations using midPoint achieve this because the provisioning engine executes revocation across all connected systems in a single automated pass. Compare this to the 42% of organizations that take more than a week.

The edge cases that break simple automation

Every JML implementation handles the straight path: new hire, department transfer, termination. The projects that deliver real value are the ones that also handle the cases below. midPoint’s flexible policy engine and lifecycle state model make these tractable rather than exceptional.

Rehires

An employee leaves in March and returns in September. Do they get a new identity or reactivation of the old one? If the old identity is reactivated, which access rights are restored – the ones they had when they left, or the ones appropriate for their new position?

midPoint handles rehires through focal object preservation. The identity record is retained in a suspended lifecycle state. When the HR system creates a new record that matches the old identity (by employee ID, national ID, or correlation rules), midPoint reactivates the existing identity rather than creating a duplicate. Role assignments are re-evaluated based on the new position, not the old one. Audit history is preserved continuously.

Contractors and external users

Contractors do not exist in the HR system. They have no HR joiner event, no department code, and no automatic termination date. They are typically onboarded through a request from the sponsoring manager and have a fixed contract end date.

midPoint manages external identities through separate lifecycle policies. A contractor identity requires a sponsoring owner (a human employee), a defined end date, and periodic recertification. When the contract end date arrives, midPoint deactivates the identity automatically. When the sponsoring owner leaves the organization, midPoint flags the contractor identity for ownership reassignment or deactivation.

Parental leave and long-term absence

An employee on parental leave should not have their identity deleted. But should they retain active access to production systems for twelve months while they are away?

midPoint’s lifecycle state model supports suspension states that deactivate accounts without revoking role assignments. When the employee returns, reactivation restores their previous access profile without requiring a new provisioning cycle. If their role or department changed during the absence (restructuring, for example), the reconciliation engine adjusts automatically.

Multiple simultaneous positions

In universities, hospitals, and research organizations, a single person may hold multiple positions simultaneously: a professor who is also a department head and a research project lead. Each position carries different access requirements.

midPoint supports multiple assignments per identity. Each assignment can carry its own role set, validity period, and organizational context. The identity’s effective access is the union of all active assignments, evaluated against SoD policies to prevent conflicts.

Mergers and organizational restructuring

When two departments merge, or a company acquires another, the organizational structure changes for hundreds or thousands of identities simultaneously. Manual re-provisioning at this scale is not feasible.

midPoint’s policy-driven approach handles restructuring by updating organizational unit mappings. When the org structure changes in the HR system, midPoint re-evaluates every affected identity against the new structure and adjusts role assignments accordingly. The process is audited, reversible, and can be simulated before execution.

The implementation approach that works

Evolveum’s methodology for JML deployment follows a three-phase pattern: Connect, Cleanup, Automate. This sequence matters because automating on top of dirty data produces automated garbage.

Phase 1: Connect (weeks 1–4)

Connect midPoint to the HR system and target systems. Pull identity data. Pull account data. Do not automate anything yet. The goal is visibility: how many identities exist in the HR system, how many accounts exist in each target system, and how do they correlate?

midPoint’s smart correlation engine matches identities across systems even with inconsistent naming, missing fields, or transliteration differences. The output is a map of your actual identity landscape – including orphan accounts, duplicate identities, and accounts with no HR match.

Phase 2: Cleanup (weeks 3–6)

Before automating lifecycle events, clean the data. Assign owners to orphan accounts. Resolve duplicate identities. Remove accounts that belong to people who left years ago. Align role definitions with actual access patterns using midPoint’s role mining capabilities.

This phase is where most of the hard decisions happen. It is also where the most immediate security value is delivered – before any automation is turned on, you have already closed the orphan-account gap.

Phase 3: Automate (weeks 5–12)

With clean data and validated correlation, enable automated provisioning. Start with joiners (lowest risk – new accounts, no existing data to corrupt). Move to leavers (high security value – automated deprovisioning closes the biggest governance gap). Finish with movers (highest complexity – requires validated role models and SoD policies).

Each automation step runs in simulation mode first. midPoint evaluates what the automation would do against production data without executing changes. You review the results, adjust policies, and enable execution only when the simulation matches expectations.

The measurable impact

Organizations that implement JML automation with an IGA platform report consistent improvements across security, efficiency, and compliance metrics:

• Provisioning time reduced by 73%, from days to hours or minutes
• Deprovisioning time reduced significantly, from weeks to minutes
• Identity-related security incidents reduced by over 67%
• Audit pass rates exceeding 95% for SOC 2 and ISO 27001
• Helpdesk ticket volume for access requests reduced by 40–60%
• Privilege creep incidents reduced through automated mover re-evaluation

The ROI is not theoretical. Forrester’s 2025 Total Economic Impact study of enterprise IGA automation (commissioned by Saviynt, but representative of IGA-class automation outcomes) measured 269% ROI with payback under nine months, including 577,000 hours saved on manual provisioning and access reviews. The specific numbers will vary by platform and environment, but the order of magnitude is consistent across IGA implementations.

Start your JML automation project

WeKnowIdentity has delivered 10+ enterprise midPoint deployments managing up to 1,000,000+ identities across telecom, finance, government, healthcare, education, and technology sectors. Our team holds four Evolveum midPoint certifications and has hands-on experience with JML automation projects ranging from single-HR-source deployments to complex multi-source, multi-country environments.

If your onboarding still involves helpdesk tickets, your offboarding still takes more than a day, and your movers still accumulate privileges from every role they have ever held – those are the gaps that JML automation closes first.

Book a free JML assessment

Related Resources

• midPoint Consulting and Implementation Services
• Our Implementation Methodology
• SAP IDM to midPoint Migration
• Microsoft MIM to midPoint Migration
• GDPR Compliance with midPoint

Sources

• CloudEagle 2025 IGA Report. 60% manual provisioning, 42% take over a week to revoke access, 73% faster automated provisioning.
• Gartner 2024 IAM Research. 3–5 day provisioning delays, 40% first-week productivity loss.
• IBM Cost of a Data Breach Report 2025. Credential-based breaches as dominant attack vector.
• Dark Reading / ID Dataweb 2025. 50% of ex-employees retain access post-departure.
• Orchid Security 2025. 44% of organizations report 1,000+ orphaned accounts, 27% of cloud breaches involve dormant credentials.
• Forrester / Saviynt TEI Study 2025. 269% ROI, payback under 9 months, 577,000 hours saved.
• ID Dataweb 2025. Automated JML reduces identity security incidents by 67%.
• Evolveum midPoint Documentation. JML lifecycle, correlation, reconciliation, simulation.
• Evolveum First Steps Methodology. Connect-Cleanup-Automate approach.