Skip to lesson
Exit
Identity & Access Deep Dive1 / 3

1 min lesson

Joiner

Start at the first move in "Joiner" and carry it through to the proof.

Step 1 of 3

Joinerinstant day-one experience

  1. 1Trigger. HRIS marks a new hire active on the start date (or a few days ahead for pre-provisioning).
  2. 2Create identity. IdP creates the account, sets the username convention and enrolls MFA.
  3. 3Assign group-based access. Role + department drive group membership; groups auto-grant the right SaaS apps via SCIMSystem for Cross-domain Identity Management. A standard for automatically creating and removing user accounts when people join or leave. Press Enter for the full definition. - no manual app-by-app grants.
  4. 4Provision the device. MDM zero-touch enrollment ships a configured laptop tied to the new identity.
  5. 5Day-one experience. Welcome flow, accounts ready, no "file a ticket to get Slack" friction.
Learn more

Full explanation

Mover

Moverthe case people forget

A role or department change should recalculate access automatically - add what the new role needs, remove what the old one granted. The failure mode is access accretion: people collect permissions as they move and never lose the old ones, which is how you end up with a marketing manager who can still touch the finance system.

Watch out

Movers are where most JML designs leak. If you only add access on a transfer and never revoke the prior role's groups, you build standing privilege that no access review can keep up with. Say explicitly that a mover event recomputes the full group set and removes stale membership - that one sentence separates a real design from a checklist.