IDENTITY LIFECYCLE MANAGEMENT

Your IAM workflow says the leaver was processed. Your auditor asks for proof. Can you show it?

The ticket closed on day one. Forty-seven days later, the leaver's API key still works. Most organizations can run joiner-mover-leaver (JML) processes. Far fewer can prove that access was actually removed - from the directory, every SaaS app, API keys, privileged accounts, and the sessions that outlive them all.

Identity Lifecycle Management is the practical, vendor-neutral architecture guide for closing that gap, with 16 ready-to-use appendices: deprovisioning checklists, review campaign templates, RACI catalogs, event matrices, risk registers, and a master architecture review checklist.

One idea runs through all 22 chapters

Workflow completion is not control completion. The book's three-level model (workflow, target, and control completion) shows you what to automate, what to verify independently, and what to report honestly as residual risk.

What's inside

• Part I - Foundations: Get the source of truth right with identity models, authoritative sources, and lifecycle states
• Part II - Provisioning: Know when "request accepted" really means "access changed," and catch drift with reconciliation and SCIM
• Part III - Joiner, Mover, Leaver: Ready on day one, no access creep on moves, full containment on exit, plus rehires, contractors, and dual roles
• Part IV - Requests and Reviews: Block self-approval, route by risk, and run certifications that prove revocation, not just sign-off
• Part V - Governance and Operations: Decision rights, lifecycle threat models, safe recovery, and metrics that can't be gamed
• Part VI - Implementation: A staged rollout with release gates, following Meridian Vale Financial Group end to end

Built for practitioners

For IAM architects, identity engineers, and the auditors and GRC teams who sign off on their work. Every chapter follows the same path: a real-world scenario, the architecture, design guidance, a worked artifact, failure modes and controls, and a decision scenario to test yourself.

After reading, you will be able to

• Separate identity, account, entitlement, and session state
• Design lifecycle state machines that reject out-of-order events safely
• Calculate exact access deltas for movers instead of stacking roles
• Run access reviews that verify revocation, not just completion
• Report residual risk honestly, and defend it to a risk committee

No product endorsements. No vendor lock-in. Architecture that works on any platform.

Identity and Access Management Architecture Series - Volume 4. Also available: Volume 1 (Fundamentals), Volume 2 (Authentication Architecture), and Volume 3 (Authorization and Access Control Architecture).