1 min lesson
Joiner
Start at the first move in "Joiner" and carry it through to the proof.
Step 1 of 3
Joinerinstant day-one experience
- 1Trigger. HRIS marks a new hire active on the start date, or a few days ahead for pre-provisioning.
- 2Create identity. IdP creates the account, sets the username convention and enrolls MFA.
- 3Assign group-based access. Role + department drive group membership; groups auto-grant the right SaaS apps via SCIMSystem for Cross-domain Identity Management. A standard for automatically creating and removing user accounts when people join or leave. Press Enter for the full definition., with no manual app-by-app grants.
- 4Provision the device. MDM zero-touch enrollment ships a configured laptop tied to the new identity.
- 5Day-one experience. Welcome flow, accounts ready, no "file a ticket to get Slack" friction.
Learn more
Full explanation
Mover
Moverthe case people forget
A role or department change should recalculate access automatically: add what the new role needs and remove what the old one granted. The failure mode is access accretion. People collect permissions as they move and never lose the old ones, which is how you end up with a marketing manager who can still touch the finance system.
Movers are where most JML designs leak. If you only add access on a transfer and never revoke the prior role's groups, you build standing privilege that no access review can keep up with. Say explicitly that a mover event recomputes the full group set and removes stale membership. That one sentence separates a real design from a checklist.