Joiner, Mover, Leaver (JML): The Complete Guide to JML Automation
Gregg DavisUpdated 10 min read
Joiner, mover, leaver, usually shortened to JML, is the model IT and HR use for the three moments that change a person’s access: when they join, when they move roles, and when they leave. Each event should trigger a precise change in Active Directory and Entra ID.
When those changes are manual, joiners wait for access, movers collect permissions they should have lost, and leavers keep access long after they’re gone. JML automation closes all three gaps by turning HR events into directory changes without a ticket in between.
This guide explains how JML automation works, what to automate at each stage, the benefits, the tools that do it, and how to roll it out. If you need the basics first, start with our explainer on the JML process.
What Is JML Automation?
JML automation replaces manual access tasks with rules. Instead of IT reading an email from HR and creating accounts by hand, systems react to HR updates and apply the matching access changes automatically.
It breaks the identity lifecycle into three triggers:
- Joiner: A new employee or contractor starts. They need an account, role-based access, a license, and a mailbox, ideally before day one.
- Mover: An existing person changes role, department, location, or manager. Their access has to match the new role, and the access tied to the old role has to go.
- Leaver: A person exits the organization. Their access must be revoked promptly and completely, their license reclaimed, and their data handled per policy.
Each trigger maps to rules based on role, department, location, and manager. Because the rules are defined once and applied the same way every time, automation delivers least-privilege access by default and a timestamped record of every change.
How JML Automation Works
JML automation connects your HR system, the source of truth for joiners, movers, and leavers, to your directory, where access lives:
- HR records the event: a hire, a role change, or a termination.
- The rules engine evaluates it against your documented access logic: which account to create, which organizational unit it belongs in, which groups and licenses it gets.
- The plan is checked before anything is written, so a bad HR import can’t disable half the company.
- Active Directory and Entra ID are updated. Accounts, security groups, licenses, and mailboxes are created, changed, or revoked.
- Everything is logged for audit, and changes that need attention trigger a notification.
This is the same engine behind IT onboarding automation and Active Directory user provisioning. JML is simply the lifecycle view of it.
What to Automate at Each Stage
Not every JML task needs a person. Here’s what automation should handle at each stage.
Joiners
- Create the account from the HR record, with a consistent username and email address.
- Place it in the right organizational unit and add it to groups by role, department, and location.
- Assign the Microsoft 365 license and set up the mailbox.
- Fill in directory attributes such as title, department, manager, and office, so address lists and dynamic groups stay correct.
The result is a new hire who can sign in on day one, without a single onboarding ticket.
Movers
- Detect changes to title, department, location, or manager in the HR record.
- Add the groups and licenses the new role needs.
- Remove the groups tied to the old role, so access doesn’t pile up.
- Update the directory attributes that drive org charts, address lists, and approval chains.
Movers are where manual processes fail most often. Adding new access is easy to remember. Removing old access usually isn’t.
Leavers
A leaver is anyone whose relationship with the organization is ending: a resignation, a termination, the end of a contract, or a retirement. It’s the highest-risk event in the lifecycle, because every account the person holds becomes a liability the moment they leave.
The danger is the gap between when someone leaves and when their access is removed. Manual offboarding can leave that window open for days or weeks. Automation closes it:
- Disable the account on the termination date, or immediately for an urgent exit.
- Remove group memberships and reclaim licenses.
- Convert or hand over the mailbox according to policy.
- Move the account to a disabled-users OU and record what was done.
This is the deprovisioning side of the lifecycle. See what deprovisioning is and why it matters and no-touch IT offboarding for more.
7 Benefits of JML Automation
Automated JML workflows pay off well beyond saving a few clicks.
1. Stronger Security
When joiners, movers, and leavers are handled late, accounts and permissions stay active longer than they should. Automation follows predefined rules. Joiners get exactly the access their role needs, movers lose what their old role gave them, and leavers are cut off on time.
2. Faster Onboarding
New hires don’t sit idle waiting for email, licenses, or system access. Their accounts are ready when they start, which shortens time to productivity and gives them a better first impression of IT.
3. No More Privilege Creep
Manual updates tend to add access but forget to remove it. Automation removes the old role’s groups as part of every move, so permissions stay aligned with the current job.
4. Fewer Human Errors
Manual JML work leads to typos, wrong groups, and forgotten revocations. Rules apply the same logic every time, so access follows policy rather than whoever happened to pick up the ticket.
5. Easier Compliance and Audits
Regulations and security frameworks expect tight control over user access. Automated workflows record each action, so you can show who had access, when it changed, and why. An access review turns into an export instead of a week of digging through tickets.
6. Less IT Workload
IT teams spend hours creating accounts, updating access, and closing requests. Automation takes those repetitive tasks off their plate and cuts onboarding tickets, so they can focus on projects that matter.
7. Lower Costs
Licenses are reclaimed when people leave, so you stop paying for departed users. IT capacity no longer has to grow with headcount, and you avoid the cost of incidents caused by forgotten accounts.
Signs Your Manual JML Process Is Holding You Back
If any of these sound familiar, it’s time to automate:
- Nobody can see where a request is stuck. JML work lives in email and tickets, so IT can’t tell who owns a request or whether access was updated everywhere.
- HR and IT don’t talk. IT finds out about hires, transfers, and exits late or from the wrong channel, and has to chase managers for details.
- Similar roles have different access. Different admins grant access in different ways, so permissions are uneven across the company.
- Movers keep their old access. People who changed jobs years ago can still reach systems from their previous role.
- Ticket volume rises with every hire. Each joiner, mover, and leaver creates a request that needs review, approval, and follow-up.
- Audits mean a scramble. Proving when access was removed means rebuilding timelines from scattered systems.
Tools That Automate the JML Process
Several kinds of tools can automate JML work. Many organizations combine more than one.
HR-Driven Provisioning Tools
These connect your HR system directly to your directory. When HR records a change, the tool creates, updates, or disables the account in Active Directory and Entra ID by your rules. This is the most direct way to automate JML for organizations that run on Microsoft. ezOnboard and Aquera are two of them, and ezOnboard vs Aquera sets them side by side.
Identity and Access Management Platforms
Identity and access management tools control who can sign in and what they can reach, through SSO and MFA. Many can create, update, and remove accounts in connected apps once the identity exists in the directory.
Identity Governance and Administration (IGA)
IGA software focuses on oversight: access policies, approvals, and periodic access reviews. It’s useful when movers need approvals or when auditors expect formal certification of who has access to what.
Workflow Automation Tools
IT process automation tools trigger steps across systems when an event happens, such as opening a ticket for a laptop or notifying a manager. They’re good at coordinating the non-directory parts of JML.
User Provisioning Software
User provisioning software creates and removes accounts across many applications, often through SCIM. It extends JML automation from the directory to the SaaS apps behind it.
How to Get Started With JML Automation
A rollout goes smoother in small steps.
- Clean up your HR data. Automation is only as good as its source. Make sure titles, departments, managers, locations, and start and end dates are complete and consistent.
- Write down your access rules. Decide which OU, groups, and licenses each role, department, and location gets. Start with the common roles and handle exceptions later.
- Start with joiners and leavers. They’re the most frequent events and the biggest risks. Get them right first.
- Preview before you go live. Run the rules against your current HR data and check what would change before anything is written.
- Add movers. Once joiners and leavers are stable, automate role changes, including the removal of old access.
- Review and refine. Watch the logs and notifications, track how long provisioning and deprovisioning take, and tighten the rules as you learn.
Automate JML With ezOnboard
ezOnboard automates the full joiner, mover, and leaver lifecycle from your HR system into Active Directory, Entra ID, and Exchange.
The ezOnboard agent runs inside your network and checks your HR system for changes every few minutes. Your rules decide who gets an account, which OU it goes in, which groups and licenses it receives, and which attributes are set. Safety rails check each plan before it’s written, and a sync that would cross your limits stops and notifies your team. Every event, the rule it matched, and the changes it made are recorded for audit.
New hires are ready on day one, movers’ access follows their role, and leavers are disabled and their licenses reclaimed as soon as HR records the exit.
Request a demo to see it with your HR system, or check the ROI calculator to estimate your savings.
Frequently Asked Questions
What is JML automation?
JML automation replaces manual access tasks with rules that react to HR events. When HR records a hire, role change, or exit, the matching accounts, groups, licenses, and mailboxes are created, updated, or removed automatically. This reduces security risks, errors, and IT workload.
What is the difference between a mover and a leaver?
A mover stays with the organization but changes role, so their access is adjusted. A leaver exits entirely, so their access is fully revoked and their license reclaimed.
Why is the leaver stage the riskiest?
Any access left active after someone departs is an open door. The longer the gap between the exit and deprovisioning, the greater the exposure. That’s why leaver actions should be tied directly to the HR termination event.
Is JML the same as the employee lifecycle?
JML is the access-focused view of the employee lifecycle. The broader employee lifecycle includes recruiting, development, and retention. JML zeroes in on the three events that change a person’s access.
Can JML automation handle contractors?
Yes. Contractors are often the hardest group to keep clean because they arrive and leave quickly. As long as they’re recorded in the HR system, the same rules provision and deprovision them on their own timelines.
Do I need an IGA platform to automate JML?
Not necessarily. Many organizations automate JML by connecting their HR system to Active Directory and Entra ID, then using SSO and SCIM to extend access to other apps. IGA platforms add formal approvals and access certifications, which larger or highly regulated organizations often need.