Lifecycle & Account Provisioning
Identity solution
Automate joiner, mover, and leaver outcomes by creating, updating, and retiring accounts from trusted source data.
At a glanceDirect link to At a glance
Lifecycle automation defines when and why account and access changes happen as people join, move within, or leave an organization. User provisioning, also called account provisioning, creates and maintains accounts in connected target systems. Access provisioning assigns the required group-based access or other connector-supported entitlements. Deprovisioning disables or removes accounts and revokes access when eligibility ends. NIM coordinates these outcomes through collected source and target data, relations, filters, mappings, roles, jobs, and schedules.
Verify success: Test with a limited, safe population before scheduling automation. Confirm the intended accounts, attributes, and access in each target system, then review job results for changes that could not be applied.
Design each lifecycle outcomeDirect link to Design each lifecycle outcome
| Lifecycle outcome | Authoritative signal | NIM workflow | Verify before scheduling |
|---|---|---|---|
| Joiner | A person becomes eligible for employment, enrollment, or another covered population. | Use a filter to select the person, mappings to prepare required accounts, and roles to apply baseline access. Use onboarding when the person must securely activate access. | The selected person receives the intended accounts, attributes, and baseline access without exposing credentials. |
| Mover | A role, department, location, manager, status, or other source attribute changes. | Use filters and role models to identify the changed eligibility, then apply the required mapping or role membership changes through a job. | The new access is present and access that no longer applies is handled according to the defined rule. |
| Leaver | A person leaves the covered population or requires urgent access removal. | Use a clearly scoped filter and target operations to disable, remove, or otherwise change managed accounts and access. Use the controlled termination experience when an urgent, administrator-led response is appropriate. | The selected accounts and entitlements have the intended state in every managed target system. |
The exact source attributes, target actions, and timing are implementation decisions. Keep each event definition explicit: identify the source of truth, the qualifying filter, the target systems in scope, and the expected result when a record is processed.
Account provisioningDirect link to Account provisioning
Provisioning turns each lifecycle rule into a repeatable target-system change. The same workflow can also synchronize account attributes from authoritative data without a separate onboarding or termination experience.
Collect current data
Select the right record
Define the change
Run the change
Verify the result
Build the solutionDirect link to Build the solution
Connect source and target systems
Connect the authoritative source and every managed target system, collect their data, and inspect it in the Vault.
Match and select people
Create relations to match people and accounts, then use a focused filter for one outcome. Test people who should qualify, should not qualify, and represent missing or changing data.
Configure account and access changes
Configure mappings for the required account actions and attributes, and roles for access where needed; add them to a job.
Test and verify results
Run the job manually for a limited, safe population and confirm every target-system result.
Schedule and monitor
Set a sync task frequency that matches the urgency of the event, then review job results after scheduled runs.
If a selected person does not receive the expected account or access change, use provisioning troubleshooting before retrying a broader job.
Recommended pathDirect link to Recommended path
- Start with Build your first workflow to validate a limited change using your own systems.
- Follow the provisioning tutorial for an end-to-end HR-to-Active Directory example that creates accounts and keeps them synchronized.
- Use the onboarding tutorial when joiners need to verify their identity, set a password, and activate prepared access without sharing credentials.
- Use Emergency Termination for a controlled, administrator-led response to urgent exits.
- Review job results and use Administration & operations to monitor scheduled outcomes and respond to failures.
If systems, relations, mappings, and jobs are not yet in place, complete Your first provisioning workflow first.