1 min lesson
Joiner
Start at the first move in "Joiner" and carry it through to the proof.
Step 1 of 3
Joinerinstant day-one experience
- 1Trigger. HRIS marks a new hire active on the start date (or a few days ahead for pre-provisioning).
- 2Create identity. IdP creates the account, sets the username convention and enrolls MFA.
- 3Assign group-based access. Role + department drive group membership; groups auto-grant the right SaaS apps via SCIMSystem for Cross-domain Identity Management. A standard for automatically creating and removing user accounts when people join or leave. Press Enter for the full definition. - no manual app-by-app grants.
- 4Provision the device. MDM zero-touch enrollment ships a configured laptop tied to the new identity.
- 5Day-one experience. Welcome flow, accounts ready, no "file a ticket to get Slack" friction.
Learn more
Full explanation
Mover
Moverthe case people forget
A role or department change should recalculate access automatically - add what the new role needs, remove what the old one granted. The failure mode is access accretion: people collect permissions as they move and never lose the old ones, which is how you end up with a marketing manager who can still touch the finance system.
Movers are where most JML designs leak. If you only add access on a transfer and never revoke the prior role's groups, you build standing privilege that no access review can keep up with. Say explicitly that a mover event recomputes the full group set and removes stale membership - that one sentence separates a real design from a checklist.