Joiners, movers, leavers —
handled, with receipts.

One lifecycle monitor

Every HR event, and what the platform did about it.

Joiners get their birthright access from policies, movers trigger a review of what they carried along, leavers get revoked and their accounts wound down on the grace window you set. Leaver clean-up is convergence, not a message: the next reconciliation run finds a terminated identity with a live account and disables it. Nothing had to fire at the right moment, so nothing can have been missed. Rejoiners are their own event, not a second joiner. And the monitor tracks how long each one actually took — measured on the same clock the enforcement uses, so the finding and the engine cannot disagree — so a leaver that missed its SLA surfaces as an exception instead of a surprise at audit.

• Birthright via access policies — provenance on every grant
• Day one is not a silent wait: on password tenants a new joiner's login invite goes out with the HR sync itself — no per-person admin click. On SSO tenants the first login simply works, and the platform knows the difference
• Mover events spawn a review of the context-bound access they carried over — immediately, not next quarter
• And the person who moves sees their own move: "changes to my role" is a lane on their own requests page — will I lose access when I switch teams is a question with an answer, not a surprise
• When a manager or owner changes, their pending decisions move at that moment — not at the next sync. A task somebody already took over by hand stays where it is
• Leaver enforcement: revoke, move the account to the OU you nominate, disable — then delete it in Active Directory once the grace window expires
• Privileged access drops the moment someone is terminated, grace window or not
• Grace and delete-after windows set per account type — an admin account needn't wait like a standard one