How joiner, mover, leaver works¶
Nothing in the lifecycle is a single feature. A person arrives from HR, a rule decides they should have an account, an account definition decides what kind, another rule decides where it is created and what it is called, and separate rules decide what it may do. Each link is configured on its own — which is what makes the process adaptable, and why it is worth reading once end to end.
The chain, in one view¶
| # | Step | What decides it | Where it is controlled |
|---|---|---|---|
| 1 | A person appears | The HR system is authoritative | The HR synchronisation, Connectivity › Synchronisation |
| 2 | They should have an account | A business role whose assignment rule matches them | Access › Business roles |
| 3 | What kind of account | The account definition that role grants | Access › Business roles (what the role grants) |
| 4 | Where the account is created | The definition's placement settings | Access › Account definitions |
| 5 | What the account is called | The definition's prefix, and a computed field rule for the display name | Access › Account definitions, Automation › Computed field rules |
| 6 | Whether it is usable yet | The person's entry date | HR, plus a nightly job |
| 7 | What they may do | Business roles inherited from their department, employment or location | Identities › Organisation |
| 8 | Which groups that means | The groups those roles grant | Access › Business roles |
| 9 | Which of their accounts a group goes on | The role's Entitlements apply to, else the primary definition | Business role, account definition |
| 10 | Whether access is usable today | The person's status | The identity |
| 11 | What reaches the target system | The synchronisation mapping | Connectivity › Synchronisation |
The one thing to take from this table
Steps 2 and 3 are separate on purpose. A rule decides who gets an account; the account definition decides what that account is. That separation is why one person can hold two accounts on the same system — an ordinary one and an administrative one — each created, named and placed by its own rules.
The four moments¶
- Joiner
- Someone new arrives. Their accounts are created, named and placed, prepared but disabled until their first day, and given the groups their department and position need.
- Mover
- Someone's department or position changes. Their roles and groups follow automatically; their accounts move only if you have chosen that.
- Temporary absence
- Someone is away for a while — leave, suspension, secondment. Their accounts are disabled, and everything else is kept for their return.
- Leaver
- Someone leaves. Their accounts are disabled and stripped of their groups at once, and deleted after the retention period their account definition sets.
What runs on its own¶
Most of the process happens the moment a person is saved — by the HR synchronisation or by someone editing them. A few things are tied to dates rather than to changes, and those are done by scheduled jobs every night: enabling accounts on the entry date, deactivating people whose leaving date has passed, and deleting accounts whose retention has run out.