EMZETT.
Login

Emzett Wiki

User account lifecycle: onboarding, offboarding and permissions

Properties1
tagsglossar, it-betrieb, sicherheit

2 min read

User account lifecycle: onboarding, offboarding and permissions

In short: New employees need suitable accounts and rights quickly, leaving ones must lose everything immediately; a clear procedure with a checklist prevents security gaps and chaos.

In more detail: The lifecycle of an account (joiner – mover – leaver) is a core process of identity & access management (IAM). Mistakes here lead to orphaned accounts, accumulation of rights and data leaks.

In Depth

Joiner (entry/onboarding)

  • Before day 1: prepare hardware (imaging), create account (Active Directory/Entra ID/Google), email, groups/roles per job profile (RBAC), software, phone, access.
  • Hand over the initial password safely (one-time password, change at first login, set up MFA).
  • Training: data protection, IT security, policies (signature).
  • Least privilege: only what is needed.
  • Checklist + ticket for who does what; documentation.

Mover (change)

On department/role change: withdraw old rights, grant new ones (not only add: otherwise privilege creep), adjust mailboxes/groups, arrange deputies, regularly recertify permissions (supervisors confirm yearly).

Leaver (exit/offboarding)

  • Fix the time (leaving date, possibly immediately for tense terminations).
  • Disable the account (do not delete immediately: secure data/mailbox), change passwords/access, revoke MFA/token/security keys, VPN, cloud services, SaaS, Git, server SSH keys.
  • Take back devices, transfer data, forwarding/out-of-office for email, access cards/keys.
  • Change shared credentials (wiki, social media, shop).
  • Deletion periods (GDPR), retention duties.
  • Check service accounts and API keys created by the person.

Tools and verification

  • Directory services: Active Directory, Entra ID, LDAP, SSO/SAML/OIDC, SCIM (automatic provisioning), HR systems as source.
  • Automation (PowerShell, joiner workflows), self-service password reset.
  • Logs for traceability (audit).
  • Spot checks: can a departed account still log in? List of orphaned accounts.
  • Small teams/clubs: same discipline: list who has which access (server, domain, shop, social media), password manager with sharing.
  • Exam (IHK): name steps, explain role concept (RBAC), justify risks.

See also: Users, groups and file permissions, Least privilege, Group policies and Active Directory

Backlinks