Automating joiner, mover, leaver without breaking the business

JML automation fails when it is built on entitlements instead of roles. Sequence the work in this order and it holds.

Everyone agrees leaver access should be revoked the same day. The projects that deliver it reliably share one trait: they fix the role model before they touch automation.

Audit before you design

Start with what exists. Every account, group, licence and entitlement across the directory and the SaaS estate. This exercise almost always finds orphaned accounts, standing privilege that should have been temporary, and licences billed for people who left last year.

Design roles with the business, not for it

A role model written by IT alone will be wrong in the details that matter. Sit with each function, agree the access package a new starter genuinely needs, and treat anything outside it as an exception requiring approval.

Automate the events, keep humans on exceptions

The measure of a JML process is not how fast it grants access. It is whether removal happens without anyone remembering to ask.

Add quarterly reviews on top and the audit question — who has access to what, and why — becomes a report rather than a project.