Get a demo
Lifecycle

Identity Lifecycle Management: Identity Data, Sources and Governance

Gregg DavisUpdated 10 min read

Every person in your organization exists in a dozen places at once. There’s a record in the HR system, an account in Active Directory, another in Entra ID, a mailbox, and an account in each application they use.

Identity lifecycle management (ILM) is how you keep all of those copies describing the same person, correctly, from the day they’re hired to the day their last account is deleted. It’s also how you prove, when an auditor asks, that each person’s access matches who they are today.

This guide covers the identity side of that work: the identity as a record, where its data should come from, how it flows between systems, the governance that keeps it honest, and how to choose a tool. For what happens at each hire, role change and exit, see our guide to the JML process. For the steps to request, approve, grant and revoke a piece of access, see the access provisioning process.

TL;DR

  • An identity is a record spread across many systems. ILM keeps every copy accurate and linked by a stable identifier.
  • Each attribute should have one authoritative source. For people data such as title, department, manager and status, that’s usually the HR system.
  • Attributes flow from HR to the directory, and from the directory to applications. Bad data in HR becomes wrong access everywhere else.
  • Identity governance adds the policies, access certifications and separation-of-duties checks that show access is still right.
  • Choose a tool by where your identity data comes from, where it has to go, and what your auditors need to see.

What Is Identity Lifecycle Management?

Identity lifecycle management is the practice of creating, maintaining and retiring digital identities, so that each one stays accurate and its access stays appropriate for as long as it exists.

It’s easy to confuse with three neighbors, which each look at the same lifecycle from a different side.

  • ILM is about the identity record: what it contains, where its data comes from, and the rules that keep it correct.
  • The JML process is about the events that change it: a joiner, a mover or a leaver, and the steps IT takes for each.
  • The access provisioning process is about individual pieces of access: how they’re requested, approved, granted, reviewed and revoked.
  • Identity governance is the oversight layer: the policies and reviews that show the rest is working. Our article on identity governance vs. identity management covers the difference in depth.

The Identity as a Record Across Systems

An identity isn’t one account. It’s a record with several parts, copied into several systems.

What an Identity Contains

  • Identifiers. An employee ID, a username, a user principal name and an email address.
  • Attributes. Name, job title, department, manager, location, worker type, start and end dates, and employment status.
  • Entitlements. Group memberships, application roles, licenses and admin rights.
  • Credentials. Passwords, MFA methods, certificates and keys.

Where the Copies Live

The HR system holds the person. Active Directory and Entra ID hold the accounts most access hangs from. Exchange holds the mailbox. Applications connected through SSO or SCIM hold their own copies, and so do the badge system, the device management tool and any application with its own login.

Every copy can drift. A title changed in HR but not in the directory, a manager field left empty, or a department spelled two ways all end up as access that no longer fits the person.

The Anchor That Links Them

The copies need one value they all share. Names change, and email addresses change with them. An employee ID issued by HR doesn’t, so store it on the directory account and match on it, not on names.

Decide up front how you’ll handle the cases that break simple matching: rehires, name changes, people who move between employee and contractor, and two people with the same name.

Identity States

An identity passes through states, and each state should mean something specific for access:

  • Pre-hire. The record exists and the account may be created, but it isn’t usable yet.
  • Active. Access follows the person’s role.
  • On leave. Access is suspended or reduced, according to policy.
  • Disabled. The person has left. The account can’t sign in, but its data is kept.
  • Deleted. Retention has passed and the account is removed.

The state should come from HR’s employment status, not from someone remembering to change it.

Identities Without an HR Record

Contractors, vendors, guests and service accounts often never appear in the HR system. They still need an owner, a sponsor and an end date. See our guides to contractor and temporary worker lifecycles and vendor onboarding.

Authoritative Sources and Attribute Sync

The most important ILM decision is which system owns each piece of data.

One Source per Attribute

For people data, the authoritative source is usually the HR system. HR knows first when someone is hired, promoted, transferred or let go, and it’s the record payroll depends on, so it tends to be kept accurate.

Not every attribute belongs to HR. IT usually owns the username, email address and group memberships. Write it down as an attribute map, listing each attribute, the system that owns it and the systems that receive it. A change made anywhere else should be overwritten at the next sync, or blocked.

How Data Flows

In a typical Microsoft environment, data flows in one direction. The HR system feeds Active Directory, Entra Connect Sync copies Active Directory to Entra ID, and Entra ID passes accounts on to applications through SSO and SCIM provisioning.

Microsoft’s own identity governance works the same way. It can provision users from HR sources such as Workday and SuccessFactors into both Active Directory and Entra ID. For the extra steps a hybrid directory adds, see identity lifecycle management in a hybrid environment.

Mapping and Transforming Attributes

HR data rarely fits the directory as it is. Usernames have to be built from names and kept unique. Department names have to match the groups they drive. Managers have to be resolved from an employee ID to a directory account. Each of these rules is part of ILM, and each needs an owner.

Data Quality Is Access Quality

Once access follows attributes, a typo in HR becomes a permission. A person filed under the wrong department gets that department’s groups. A missing end date leaves a contractor’s account open. Fixing identity data at the source, with HR, is part of the IT team’s job. Choosing an HR system with IT integration in mind makes it easier.

Identity Governance

Accurate data tells you who someone is. Governance shows their access is still right, and gives you the evidence.

Policies

Governance starts with written rules:

  • Birthright access by role, so each worker type and department gets a standard set. See RBAC and ABAC.
  • Least privilege, so nothing is granted “just in case.” See our least privilege implementation guide.
  • Approvals, stating who can approve which access.
  • Expiry for temporary and elevated access.
  • Separate admin accounts for privileged work, never the person’s everyday account.

Access Certifications

An access certification, or access review, asks the people who know, usually managers and application owners, to confirm that each person still needs what they have. Access nobody confirms is removed.

Review privileged access and sensitive systems most often, and everything else on a regular schedule your auditors accept. Our guide to automating user access reviews covers how to run them without burying reviewers, and a user access lifecycle audit tests whether the lifecycle itself is working.

Separation of Duties

Some combinations of access are risky even when each piece is justified. Someone who can create a vendor shouldn’t also approve payments to it, and someone who requests access shouldn’t approve it.

Separation of duties (SoD) defines those combinations, blocks them when access is requested, and flags them in reviews. Microsoft Entra ID Governance, for example, can enforce separation-of-duties checks on access requests.

Reconciliation

Compare every system’s accounts with the authoritative source on a schedule. Accounts with no matching HR record, accounts whose owner has left, and accounts that haven’t signed in for months are the ones attackers and auditors both look for.

Evidence

Keep a record of every identity change, with the source event that caused it, who approved it and when it happened. Governance you can’t prove doesn’t help in an audit.

Where Identity Data Goes Wrong

The same problems appear in most environments:

  • Manual edits in the directory. Someone fixes a title in Active Directory, and the next sync puts it back, or it never syncs anywhere else.
  • More than one source of truth. Employees in HR, contractors in a spreadsheet and interns in nobody’s system.
  • Late HR entries. A start date entered the day before, or a termination entered a week after.
  • Matching on names. A rehire or a name change creates a duplicate identity, or links the wrong one.
  • No owner for non-human accounts. Service accounts outlive the projects and people that created them.

How to Choose an ILM or IGA Tool

Start with three questions. Where does your identity data come from? Where does it have to go? And what do your auditors need to see?

The Kinds of Tool

  • HR-to-directory sync. Connects your HR system to Active Directory and Entra ID, and creates, updates and disables accounts from HR records. This fits organizations whose main need is accurate accounts and group memberships driven by HR.
  • Governance in your identity provider. Microsoft Entra ID Governance adds HR inbound provisioning, lifecycle workflows, entitlement management and access reviews to Entra ID, with its own license. Okta Identity Governance adds access requests and access certifications to Okta.
  • Full IGA suites. Products such as SailPoint, Saviynt, One Identity and Omada add role mining, separation-of-duties rules across business systems and large connector libraries, with longer implementations. Our comparison of identity governance tools covers when you need one.

people working in an office

What to Check

  • Connectors. It should connect to your HR system and your directory without custom code.
  • Attribute mapping. You should be able to build usernames, map departments to groups and resolve managers.
  • Safeguards. A bad HR import shouldn’t disable half the company. Look for previews and limits on how much one run can change.
  • Audit trail. Every change should be logged with the event and rule that caused it.
  • Governance features. Certifications and SoD checks, if your auditors require them.
  • Total cost. Licenses, implementation, training and the time it takes your team to run it.

How ezOnboard Fits Into Identity Lifecycle Management

ezOnboard handles the identity data side of the lifecycle for organizations on Active Directory and Entra ID. It connects your HR system, such as BambooHR or Paylocity, and keeps accounts in step with HR records.

New hires get their account, groups, mailbox and licenses from the HR record. When HR changes someone’s role, ezOnboard updates their attributes and group memberships to match. When someone leaves, their account is disabled and their licenses reclaimed.

Every change is recorded with the HR event and the rule behind it, and safety rails stop a sync that would change more than your limits allow. ezOnboard doesn’t run access certifications or SoD checks, but accurate directory data is what those reviews depend on.

Request a demo today, or check the ROI calculator to see how much ezOnboard could save you.

FAQs About Identity Lifecycle Management

What is identity lifecycle management?

Identity lifecycle management is the practice of creating, maintaining and retiring digital identities, so that each person’s record is accurate in every system and their access fits their current role. It covers identity data, its sources and the governance that checks it.

What is the difference between identity lifecycle management and the JML process?

ILM is about the identity record and the rules that keep it correct. The JML process is about the events that change it, joiners, movers and leavers, and the steps IT takes at each one.

What is an authoritative source in identity management?

It’s the system whose value for an attribute wins when systems disagree. For people data such as title, department, manager and employment status, it’s usually the HR system. IT usually owns usernames, email addresses and group memberships.

What is the difference between ILM and IGA?

ILM keeps identities and their access up to date. Identity governance and administration (IGA) adds the oversight: policies, access certifications, separation-of-duties checks and the evidence auditors ask for. Most IGA tools include lifecycle features, but many organizations start with lifecycle automation and add governance later.

How often should access be certified?

It depends on the risk and on what your auditors and regulations require. Many organizations review privileged access and sensitive systems more often than standard access, which is commonly reviewed once or twice a year.

What tools are used for identity lifecycle management?

Three kinds: HR-to-directory sync tools such as ezOnboard, governance features in identity providers such as Microsoft Entra ID Governance and Okta Identity Governance, and full IGA suites such as SailPoint and Saviynt.