Joiner: provide account, mailbox, device, roles and access on day one.
Mover: remove rights of the old role, grant new ones. Otherwise rights accumulate.
Leaver: disable access on the leaving date, hand over data, collect devices, change passwords of shared access.
How to make the process work
Define the trigger: notification from HR instead of word of mouth.
Checklists per role with account, groups, applications, hardware.
Role-based rights instead of individual approvals.
Name owners for approvals.
Implement leaving promptly and documented, also for service providers and freelancers.
Review regularly: find inactive accounts and orphaned rights.
Automation
With a directory service and identity platform, group memberships and licences can be assigned automatically by role and department. This saves time and lowers the risk of forgotten access.