JML Process: Joiners, Movers, and Leavers Explained
Gregg DavisUpdated 15 min read
The JML process, short for joiners, movers, and leavers, is one of the most important workflows for IT teams.
Every time someone joins your company, changes roles, or leaves, their access to systems, data, and tools has to change with them. It sounds simple. In practice, IT teams deal with late HR updates, slow ticket handoffs, and systems that don’t talk to each other.
If this process is weak, you risk data breaches, compliance failures, and wasted IT time. A strong JML process improves security, saves time, and gives employees a smoother experience from their first day to their last.
This guide explains what the JML process is and how it fits into identity and access management (IAM). It walks through the steps at each stage, the challenges to expect, and the best practices that keep access accurate across the employee lifecycle.
TL;DR
- JML stands for joiners, movers, and leavers: the three moments when a person’s access has to change.
- For joiners, create the identity from the HR record, prepare accounts and devices before day one, and grant access by role.
- For movers, catch the role change quickly, remove the old role’s access, and add only what the new role needs.
- For leavers, disable accounts first, then revoke access everywhere, hand over data, reclaim assets and licenses, and record what was done.
- Automation, HR-to-IT integration, role-based access, and regular access reviews are what make the process hold up at scale.
What Is the JML Process?
The JML process is the structured way IT teams manage user identities and access across a person’s whole time at an organization. It is built around three groups:
- Joiners: New employees, contractors, interns, or vendors who need user accounts, devices, and access to company systems from day one.
- Movers: Existing employees who change roles, departments, locations, or responsibilities and need their access updated to match.
- Leavers: People who exit the company through resignation, termination, retirement, or the end of a contract. All of their access should be revoked promptly.
These three stages define how you create, update, and close digital identities. The goal is simple: the right people have the right access at the right time, and nothing more.
The same idea is often called the JML lifecycle. It describes the full path of a person’s access, from the account they receive when they’re hired to the moment it’s closed when they leave.
How JML Fits Into Identity and Access Management
In IAM, every account and permission is part of identity lifecycle management. The JML process is the operational backbone of that lifecycle. It decides when an identity is created, when its access changes, and when it’s closed.
Each JML event maps to a set of rules. A person’s role, department, location, and worker type decide what access is granted or revoked. When the rules are defined once and applied consistently, you get least-privilege access by default and a clear record of every change.
HR is where JML events begin. HR knows first when someone is hired, promoted, transferred, or let go. That’s why the HR system should be the source of truth for identity data, with the directory and the apps behind it following its lead. Our guide to identity lifecycle management covers which system should own each attribute and how identity data flows between them.
Without an effective JML process, accounts stay open too long, permissions drift away from job titles, and nobody can say with confidence who has access to what. That is how insider threats, data breaches, and compliance violations start.
The JML Process Step by Step
Each stage of the JML lifecycle needs its own clear steps. Here’s what to set up first, what to review later, and what to automate.
Joiners
The joiner stage is when new users join your company. It’s also known as the employee onboarding phase. The goal is to make new hires productive quickly without trading away security or compliance.
- Create the identity. Create the user in your main directory from the HR record, with a unique user ID, a primary email address, and the right worker type (full-time, contractor, intern) so access policies apply correctly. Turn on single sign-on (SSO) and multi-factor authentication (MFA) from the start, and log who created the account, when, and from which HR record.
- Preboard before day one. During employee preboarding, prepare a starter package of email, chat, and core systems for each department. Order devices, set up mailboxes, and coordinate equipment delivery for remote hires.
- Assign roles and groups. Use role templates for each team (finance, HR, marketing) that link to approved groups. Avoid one-off group adds. If an exception is needed, record who approved it and set a review date.
- Provision access. Grant access to applications, data, and licenses based on those roles. Automated provisioning triggers this from the HR record, which reduces onboarding tickets and gives IT time back.
- Verify within the first week. Compare the new hire’s access with their role template. Birthright access speeds up onboarding, but a default set that is too wide becomes a risk. Confirm with the manager and remove anything that doesn’t fit.
The joiner stage sets an employee’s first impression of IT. A smooth start shortens time to productivity and builds trust in IT support.
Movers
Movers are employees who change roles, teams, or duties. This is the stage where access drifts most, because people gain new permissions but keep the old ones.
- Detect the change. Your HR system should be the main trigger for role changes. Back it up with manager notices and IT service tickets, since HR updates are sometimes late.
- Map the new role. Map the person to a new role template from the same access library you use for joiners. For complex roles, attribute-based access control (ABAC) can grant access by department, job level, or location.
- Route approvals by risk. Low-risk apps can follow automatic approval tied to role-based access control (RBAC). Critical systems need clear sign-off from the manager and the app owner. Keep approvals in one system so you can audit them later. The access provisioning process covers the request, approval and review steps in detail.
- Remove legacy access first. Compare the person’s old groups, app roles, and licenses with the new template. Remove anything not on the new list. If you allow a temporary overlap for a handover, give it an expiry date.
- Provision the new access. Add the access tied to the new role. Tag anything outside the template as an exception, attach the approval, and review it later so it doesn’t become permanent.
- Recertify after the move. Within a few weeks, ask the manager to confirm the person has what the new role needs and nothing left over from the old one. Log what changed.
The goal is to balance productivity with security. Movers should never wait for the access they need, and they should never keep access they no longer need.
Leavers
Leavers are people who exit the company. This stage is also known as employee offboarding, and it carries the most risk. Every account a leaver still holds is an open door until it’s closed.
- Trigger offboarding from HR. Watch your HR system for status changes to “terminated” or “inactive,” so offboarding starts as soon as HR records the exit. For urgent or same-day exits, give managers a fast way to alert IT and security directly. For an involuntary termination, see removing access for terminated employees.
- Disable accounts first. Disable the directory account, end active sessions, and block mail, VPN, and remote access. Change the passwords of any shared accounts the person knew. This is the fastest way to cut access before the cleanup.
- Revoke access everywhere. Start with admin rights and privileged accounts, then systems that hold sensitive data such as payroll, HR, and customer records. Work through the rest with a standard IT offboarding checklist, including shared drives and team spaces. Automated deprovisioning makes this happen as soon as HR confirms the exit.
- Transfer data ownership. Before deleting anything, ask the manager to name new owners for shared folders, mailboxes, dashboards, and service accounts. Follow your data retention rules so you keep the records you need.
- Reclaim hardware and licenses. Recover IT assets such as laptops, phones, and badges. Send return labels to remote workers. Wipe devices after check-in, and reclaim software licenses once the data handover is done.
- Record the audit trail. Log when the trigger arrived, when accounts were disabled, which apps were removed, and who approved any exceptions. Keep it in one place so you can answer an auditor’s questions quickly.
- Confirm the exit. Check for remaining logins, sessions, and roles tied to the person’s email, username, or employee ID. Close the offboarding ticket only when every step is done.
Why the JML Process Matters
A well-run JML process pays off across security, compliance, and day-to-day IT work.
Stronger Security
A JML process controls access at every stage of the employee lifecycle. New users get only the access their roles need, and leavers lose access as soon as they exit. That shrinks the window in which a former employee, or anyone holding their credentials, can reach company systems.
Fewer Insider Threats
Employees who change roles often collect permissions they no longer need. A mover from finance to marketing might still reach payroll data while gaining rights to customer databases. Over time, this privilege creep exposes sensitive applications and files.
Adjusting or removing permissions as soon as roles change keeps employee access accurate and limits misuse, whether accidental or intentional.
Easier Compliance
Auditors check whether you revoke access promptly, control sensitive data, and record changes to user identities. A structured JML process documents each step and creates a reliable audit trail. You can show that only authorized staff reach critical systems and that access was removed at the right time.
A Better Onboarding Experience
When the joiner stage runs well, new hires have their applications, email, and systems on day one. They don’t need to file access requests, which means less downtime and less frustration for both the employee and IT. It also shows that IT is organized and reliable from the start.
Less IT Workload
Without a clear JML process, IT spends hours chasing HR updates, fixing access issues, and hunting for unclosed accounts. Predictable workflows remove the repetitive work, and the same steps happen the same way in every department.
Common JML Challenges (and How to Fix Them)
Even with clear steps for joiners, movers, and leavers, most IT teams run into the same problems.
Manual Processes
Many IT teams still handle JML through email, chat messages, and spreadsheets. HR sends a request, and IT creates accounts by hand in each system. Every step depends on someone remembering it.
Fix: Use a standard checklist for each stage, then automate the repetitive steps with onboarding and offboarding software. Our guide to JML automation covers how that works.
Disconnected HR and IT Systems
HR, the directory, SSO, and business apps often run as separate tools that don’t share updates. IT learns about hires, transfers, and exits only when someone remembers to pass the news on. The result is late onboarding, missed transfers, and slow offboarding.
Fix: Make the HR system the source of truth and connect it to your directory, whether that’s Active Directory, Entra ID, or both. Agree a shared JML policy that says who reports each change, how fast, and in which system.
Lack of Central Visibility
Users work across email, chat, CRM, file storage, and dozens of SaaS apps. Each system only shows its own access data. When an auditor asks who has access to what, it can take days to answer.
Fix: Bring identities into one directory or IAM platform and connect your core apps to it through SSO. Log every JML change in one place.
Fast Growth and High Turnover
When a company hires quickly or has high attrition, IT opens and closes accounts every day. Small gaps in the process turn into big problems. New hires wait for access, movers keep old permissions for months, and leavers keep access longer than they should.
Fix: Automate the joiner and leaver steps so that volume doesn’t depend on IT headcount.
Privilege Creep
People keep access from old roles and past projects, especially after internal transfers. Over the years, some users end up with far more access than their jobs need.
Fix: Remove old access as part of every move, not weeks later. Keep exceptions rare and time-limited, and run regular access reviews.
Temporary Access
Contractors, interns, and project teams often need short-term access to sensitive systems. Without an end date, that access stays open long after the work is done.
Fix: Grant temporary access with an expiry date, or use just-in-time (JIT) access that is removed automatically when the work ends.
Shadow IT
Employees sign up for apps outside IT’s control, often with their work email. Those accounts don’t follow role changes and aren’t closed when people leave, because IT doesn’t know they exist.
Fix: Give joiners the approved tools they need on day one, so they don’t look elsewhere. Then find and manage the rest, as covered in what shadow IT is and how to manage it.
Compliance and Audit Gaps
Access lives in many systems, logs in another, and approvals in email or tickets. Audits fail when records are missing, approvals weren’t saved, or leavers still have active logins.
Fix: Save every JML action and its approval in one record, and keep offboarding reports so you can prove when access was removed.
Best Practices for the JML Process
These practices keep the JML process secure and consistent as your company grows.
1. Automate Provisioning and Deprovisioning
Manual account creation and removal is where delays and errors creep in. Automation creates new accounts with the right access before the start date, and it removes access the moment someone leaves. See user provisioning and deprovisioning for each side in depth.
2. Integrate HR and IT Systems
Connecting your HR system to your directory is one of the most effective ways to strengthen the JML process. Identity changes then flow straight into provisioning. Joiners get access faster, movers get the right permissions without delay, and leavers lose access as soon as they exit.
3. Use Role-Based Access Control
RBAC tools assign permissions to roles, not individuals. Adding someone to the “Finance” group gives them the finance applications and folders. When they change roles, IT updates the group membership, not dozens of separate permissions. For more complex needs, ABAC rules based on department, location, or seniority add finer control.
4. Enforce Least Privilege
Give people only the access they need, and nothing more. Avoid “just in case” rights during onboarding. Ask department heads to confirm the access each role needs, and use time-bound access for special rights. Least privilege reduces the damage if an account is misused, and most security frameworks expect it.
5. Set Clear Responsibilities
Write down who does what. HR owns people data. IT owns the provisioning workflows. Managers request and review access for their teams. A RACI chart (responsible, accountable, consulted, informed) makes this explicit, so fewer tasks fall through the cracks.
6. Follow Onboarding and Offboarding Checklists
Checklists make sure every joiner, mover, and leaver is handled the same way. An IT onboarding checklist covers devices, collaboration tools, and role-based access. An offboarding checklist covers disabling logins, revoking access, reclaiming hardware, and retiring IT assets.
7. Review Access Regularly
Even with automation, run access reviews on a schedule, such as quarterly or twice a year. Compare access with job responsibilities, confirm privileged accounts are still justified, and check temporary access for contractors and interns.
8. Log Every JML Event
Record every provisioning step, role change, and account closure. Set alerts for anomalies, such as a leaver’s account that is still active after their exit date. A complete log makes audits faster and incidents easier to investigate.
9. Track Metrics and Improve
Measure average time to provision a new hire, time to remove access for leavers, and the number of provisioning errors. If onboarding is slow, look at automation and HR integration. If offboarding lags, look at how exits reach IT. Train your IT team on the process too, so they handle the edge cases the same way.
Automate the JML Process With ezOnboard
ezOnboard automates joiners, movers, and leavers by connecting your HR system to on-premises Active Directory and cloud-based Entra ID. You define your access rules once, and ezOnboard follows them for every change HR records.
New hires get their account, groups, mailbox, and licenses as soon as they start. When people move roles, ezOnboard updates their groups and attributes to match. When employees leave, their accounts are disabled and their licenses reclaimed. Safety rails stop a sync that would change more than your limits allow, and every change is recorded for audit.
ezOnboard helps you reduce security risks, stay compliant, and give your IT team its time back.
Request a demo today or check this ROI calculator to see your cost savings.
FAQs About the JML Process
What does JML stand for?
JML stands for joiners, movers, and leavers. A joiner is a new hire, a mover is someone who changes roles, and a leaver is someone who exits the company. Together they describe the moments when a person’s access has to change.
What is the JML process in IAM?
In identity and access management, the JML process controls user access across systems. IT teams use it to grant access when someone joins, update it when they move, and remove it when they leave. The goal is to keep access accurate, reduce risk, and support compliance throughout the identity lifecycle.
What is the JML process in HR?
In HR, the JML process connects lifecycle events with IT actions. HR records hires, role changes, and exits in the HR system, which acts as the source of truth for identity data. Those records trigger IT to create, adjust, or close accounts.
What is the JML process flow?
The JML process flow starts when HR creates or updates an employee record. That change triggers identity tasks in IT systems. Accounts are created for joiners, updated for movers, and disabled or removed for leavers.
What is a joiners, movers, and leavers policy?
A JML policy is a documented set of rules for handling employee access. It explains who reports each change, how quickly IT must act, what access each role gets, and how accounts are closed when someone leaves.
Is the JML lifecycle the same as the employee lifecycle?
No. The employee lifecycle covers a person’s whole journey, including recruiting, development, and retention. The JML lifecycle is the access-focused view of it, built around the three events that change what a person can reach.