HR & IT · Onboarding & offboarding
Joiner-mover-leaver process: onboarding and offboarding without ticket chains
A new hire, a move, a departure – and every time, emails and tickets bounce between HR, managers and IT. With FLOWSTER, the HR notification starts a defined workflow that grants, adjusts or revokes accounts, permissions and devices – with a complete log.
BITMi member · Software made in Germany · GDPR-compliant · Audit-proof · From mid-sized companies to corporations
What is the joiner-mover-leaver process?
Joiner-mover-leaver (JML) describes the lifecycle of user accounts: new employees need their access on day one (joiner), roles and permissions change when someone moves to another team (mover), and all access must be reliably revoked when someone leaves (leaver).
In many companies, onboarding and offboarding rely on checklists and individual tickets. Permissions pile up with every move, and accounts stay active after departure. FLOWSTER turns the process into a workflow and supports you with regular recertifications to keep permissions up to date.
How FLOWSTER automates the user account lifecycle
Onboarding (joiner)
The HR notification starts the workflow: account, mailbox, groups, software and hardware are created or requested based on role.
Internal move (mover)
When someone changes team or role, new permissions are granted and unneeded ones are removed – with approval.
Offboarding (leaver)
On the leaving date, the workflow disables access, hands over data, triggers device return and releases licenses.
Recertification
At fixed intervals, owners confirm their team's permissions. Unconfirmed rights are removed and everything is logged.
Typical steps a JML workflow takes over
- Create user account and mailbox based on role
- Assign groups, drives and software
- Request hardware and telephony
- Adjust permissions on moves instead of accumulating them
- Disable access on the leaving date and release licenses
- Recertify permissions regularly
Practical examples
Ready on day one
HR records the new hire in a form. The workflow creates accounts, obtains the manager's approval and informs everyone involved.
Team changes without leftover rights
The workflow compares old and new role, grants the new permissions and removes unneeded ones after approval.
Departures without forgotten access
On the leaving date, accounts are disabled, forwarding is set and licenses are released. The log documents every step.
Frequently asked questions about onboarding, offboarding and recertification
What does joiner-mover-leaver mean?
The term describes the three phases in the lifecycle of a user account: joining, moving within the company and leaving.
How is the workflow triggered?
For example via an HR form in FLOWSTER or an integration with your HR system. The workflow then carries out the defined steps.
What is access recertification?
At fixed intervals, owners confirm that their employees still need their permissions. FLOWSTER collects the permissions, requests confirmation and removes unconfirmed rights – fully logged.
Does this help with NIS2 or audits?
Automatic documentation and logging make it traceable who received or lost which permissions and when. This supports you in meeting the requirements.
What happens if a step fails?
Error handling routines can be built into every FLOWSTER workflow, for example notifying the responsible team.
Which systems can be connected?
Typically Active Directory or Entra ID, Microsoft 365, ticketing and HR systems. Further systems can be connected via interfaces and scripts.
Read more
Which onboarding or offboarding step will you automate first?
Start for free with 5 workflows or get to know FLOWSTER in our next webinar.