The situation
Lingering access typically shows up in disconnected systems. Joins, moves and departures are tracked in an HR system, but none of that information gets passed down to the applications and directory services where access actually happens. Someone is hired, changes roles or leaves, and the applications never hear about it.
The process usually breaks down in ad hoc approvals. Requests get dumped into a ticketing system with no traceability back to who authorized them, and the approving ends up with IT people or with the managers doing the hiring. When IT is filling the approval role, decisions about access are being made by people who aren't really in the approval chain.
How we approach it
The goal with lifecycle management is to make it automated and remove dependence on a manual process, and avoid decisions being made by people who aren't in the approval chain.
- Find where the changes are tracked. We look at what system joins, moves and departures are tracked in today. If there isn't a system of record yet, we establish where those changes happen in the HR system.
- Work out which systems need to talk back to it. That means sitting down with the people who run the applications and the systems of record, and figuring out which ones need to get their information from that system.
- Connect what can be connected. We look for ways to connect the system of record to downstream operational systems so changes are automated.
- Report on the rest. Where automation isn't possible yet, reporting at least gives people what they need to make informed decisions instead of guessing.
The takeaway
You end up with a system of record that tracks when people join, move or leave, connected to your downstream systems for automation or at least reporting.
When someone joins, moves or leaves, the change starts in the system of record and the connected systems follow it. For the systems that can't be connected yet, reporting shows people what needs attention, so access decisions are based on information instead of guesswork.
Where it gets complicated
At most businesses, three places each hold part of the picture: HR and payroll, where employment lives; IT, where permissions live; and business operations. Each has some information about an existing employee or what a new one should get, so the work is a balancing act between the three. Automation means reading and writing from one system into another, and that's where the disconnect shows up.
Beyond that, it comes down to the individual applications. Some have proprietary ways of handling how users are authorized, which limits what they can accept from an outside management or governance source.
Every solution is unique, and each one requires sitting down with the system owners and leadership to determine how it will be implemented.