Capability

Identity lifecycle

What it does: Leavers and movers are reflected in permissions when your HR records the change.

WIC

In short

Lifecycle management ties access to a user's status and role, so access is created when someone joins, modified when their role changes and removed when they leave. When HR marks a departure or role change, Okta can remove or adjust access through SCIM and other provisioning in connected apps.1

Book a callHow Okta does it ↓
4
attack types it helps against

What it is, and the attacks it stops

Access usually outlasts the reason it was granted. People move teams, finish projects and leave, and their accounts and app access stay behind unless someone removes them.

Lifecycle management starts from the source of truth for each person, such as the HR system, and applies the changes to the accounts and apps in Okta.13

That closes gaps that lead to problems such as:

1

Accounts of former employees

An account stays active after someone leaves. An attacker, or the former employee, can still sign in.

2

Access that piles up after role changes

A person moves teams and keeps the old rights as well as the new ones. Their account becomes a bigger target over time.

3

Orphaned and forgotten accounts

An account has no clear owner, so nobody notices when it is misused.

4

Contractor access that never ends

A vendor finishes a project, but the account stays open with no end date.

Before and after rollout

Without
With
WithoutOffboarding depends on someone remembering to send a ticket to each app owner.
WithOkta can deprovision accounts in connected apps when a user's status changes.1
WithoutEach team keeps its own list of who has access.
WithUsers, attributes and groups are kept in one directory in Okta.3
WithoutJoiner, mover and leaver steps are manual and differ from team to team.
WithOkta Workflows can automate the steps, so they run in a consistent way each time.2
WithoutNobody checks regularly whether people still need what they have.
WithOkta Identity Governance supports access reviews, so owners can confirm or remove access.4

How Okta does it

Okta Lifecycle Management connects your people data to your apps. You can start with a few apps and extend it.

1

A change happens in the source system

Someone joins, changes role or leaves, and that is recorded in the HR system or another source of truth.1

2

Okta updates the user profile

The change reaches the user's profile and groups in Okta's directory.3

3

Rules decide what changes in the apps

Rules in Okta decide which accounts and access are created, changed or removed in connected apps.1

4

Automation covers the extra steps

Okta Workflows can run additional steps, such as notifying a manager or an app owner.2

WIC
Who it protectsStaff, contractors, admins
Lifecycle ManagementOkta Lifecycle Management automates provisioning and deprovisioning in connected apps that support those operations.1
Universal DirectoryOkta Universal Directory stores user profiles and attributes that rules and groups can use.3
WorkflowsOkta Workflows lets you automate identity processes without writing custom code for each one.2
Access reviewsOkta Identity Governance supports reviews of who holds which access.4

How Zelto implements it

The technology behind Okta is the ready and proven half - Zelto maps your joiner, mover and leaver processes, your sources of truth and your exceptions. We plan rollouts in groups to minimize risk/impact. We start with the apps where leftover access would cost the most.

Typical rollout

  1. Map the source of truth and the apps

    We list which system owns each person's status and role, and which apps hold accounts for them.

  2. Define joiner, mover and leaver rules

    We write down what access each role gets and what is removed when someone changes role or leaves. We also agree what happens to data and mailboxes.

  3. Pilot with one department

    We start with one department and a few apps. Before any rule becomes automatic, we agree on an owner on your side. We also agree on when to switch over and when to roll back.

  4. Connect apps one at a time

    We connect apps in Okta in priority order. Each app gets a test for a leaver and a mover before it goes live. Your help desk gets a script for the questions that follow.

  5. Review exceptions and contractors

    We review manual exceptions, contractor end dates and unowned accounts on a schedule.

Pitfalls we plan for

The HR data is late or wrong.

−Automation follows the HR record, so a late leaver date leaves the account open and a wrong role grants the wrong access.

+Agree who owns the HR data, how quickly changes are entered, and how an urgent leaver is handled outside the normal process.

An employee changes role.

−Add the new access and leave the old access in place, so rights pile up.

+Define what each role gets, and remove access that the new role does not need.

Contractors and temporary staff join for a project.

−Create the account with no end date, so it stays open after the project.

+Give each contractor their own account with an end date and a sponsor who confirms it or lets it expire.

Want leavers and movers reflected automatically when HR records the change, without a manual checklist?

We review how access is granted and removed in your company today. Then we tell you what to automate first.

Book a call30 minutes, no slides. We look at how your joiner and leaver process works today.

Related blog posts

Notes from rollouts

Okta JML SCIM Lifecycle AutomationRead on the blog →D is for DeprovisioningRead on the blog →

Sources

Official Okta and Auth0 documentation and primary legal sources.

  1. 1Okta Lifecycle Managementokta.com product page
  2. 2Okta Workflowsokta.com product page
  3. 3Okta Universal Directoryokta.com product page
  4. 4Okta Identity Governanceokta.com product page