Home / Insights / Joiners, movers and leavers — the quiet process that protects your business

Joiners, movers and leavers — the quiet process that protects your business

Joiners, movers and leavers: the least glamorous part of IT, and one of the most important. Nobody notices a good leavers process until it is missing.

In schools and nurseries, getting access right was a safeguarding issue. A new member of staff needed the right systems on day one. A leaver’s access needed to go the moment they left, because children’s data was involved. That is why I automated as much of onboarding and offboarding as I could in Microsoft 365 — not for neatness, but so the process did not depend on someone remembering under pressure.

In business IT the reasons sound different: protecting commercial data, customer information, and the systems the company runs on. The principle is identical. Access should match the role, change when the role changes, and end when the person leaves — without relying on a checklist and good intentions.

Why “we’ll remember” fails

Most organisations do not fail at joiners/movers/leavers because nobody cares. They fail because the process sits across HR, managers, and IT, and the moments that matter are messy: a Friday leaver, a role change mid-project, a contractor who “only needed SharePoint for a week.”

When offboarding is manual, dormant accounts linger. Shared passwords get reused. A mover keeps finance access “just in case.” None of that looks dramatic on the day. It becomes a problem the first time something sensitive walks out with a former colleague — or the first time an auditor asks who still has access to what.

Joiners fail quietly too. If day-one access is incomplete, people borrow logins, save files to personal drives, or invent local workarounds that never get cleaned up. You have not only slowed the new starter; you have seeded the next security conversation.

What “good” looks like in practice

A working joiners/movers/leavers process is boring in the best way:

• Joiners — accounts, groups, devices, and apps ready for day one, based on the role, not a copy of the last person’s access.
• Movers — access reviewed when someone changes team or responsibility, including what they no longer need.
• Leavers — disable or remove access promptly; reclaim devices and licences; redirect mail and files to the right owner.

Automation helps because humans are busy. In Microsoft 365 that can mean standardised groups, clear naming, joiner packs tied to roles, and leaver runbooks that are triggered by HR — not by whoever happens to spot the leaving email. The goal is not a perfect identity platform on day one. It is a repeatable path that still works when three people are off and the leaving notice arrives at 4pm.

From safeguarding to commercial protection

In education, the urgency was obvious: children’s data. In business, the urgency is commercial data, customer records, supplier portals, banking access, and the SaaS tools that hold the company’s memory. The labels differ. The discipline does not.

Treat movers with the same seriousness as leavers. A promotion or secondment that adds access without removing the old rights is how privilege accumulates. A short access review at role change is cheaper than explaining a broad entitlement later.

If your process is still partly a spreadsheet and a hope that managers will email IT in time, you are one busy week away from an account that should not exist. Ask yourself honestly: how automated is your joiners/movers/leavers process — fully, partly, or still a checklist and good intentions?

A simple health check

You do not need a long project to see where you stand. Pick last month’s joiners and leavers and walk the trail: were accounts ready on day one? Was access removed the day they left? Did any shared mailboxes or supplier portals still list them? The gaps you find are the process, not bad luck.