New employees should be able to work on their first day, and departing employees should no longer have access on their last day. That sounds obvious, but in practice it often fails due to late information, distributed responsibilities and many manual individual steps. Forgotten accounts of former employees are a well-known security risk, because they can continue to be used unnoticed.
Professionals also speak of the joiner-mover-leaver process, because besides joining and leaving, moving within the company is part of it too.
How do IT onboarding and offboarding work?
The starting point is reliable notification from the HR department: who starts, moves or leaves when, in which department and in which role. Companies often work with role profiles that define which accounts, groups, applications and devices a role receives by default.
During onboarding, a user account, for example in Microsoft Entra ID, a mailbox, licenses, group memberships and a preconfigured device are typically provided. During offboarding, the account is blocked, active sessions are ended, permissions are revoked and devices are taken back. This also includes removing registered multi-factor methods and mobile devices, and handling forwarding and out-of-office messages. Mailbox and files are handed over, retained or deleted according to defined rules.
Many of these steps can be automated, for example via workflows triggered by an entry in the HR system. This is a typical field of application for process automation.
Typical examples
- A sales employee starts on Monday, and the notebook, account, CRM access and smartphone are ready.
- A project manager changes departments. Old permissions are removed instead of only adding new ones.
- In the case of an immediate suspension from duty, all access is blocked at short notice, including cloud services and shared credentials.
- Interns and external specialists receive time-limited accounts that expire automatically on the agreed date.
What companies should keep in mind
- Keep a checklist for each role and name a responsible person for each step.
- Link HR and IT in a binding way so that joiners and leavers do not become known only by chance.
- For internal moves, recut rights according to the principle of least privilege.
- Change shared passwords after someone leaves, ideally managed centrally in a password manager.
- Document the return of devices in IT asset management.