Field note / user lifecycle

A join, a move, and a leave are three different requests wearing the same name.

Lifecycle work used to sit as a single card inside Microsoft 365 fulfilment. It earns its own lane because a joiner, a mover, and a leaver need different inputs, different urgency, and - for a leaver especially - a different owner for the clock.

Lifecycle stage

Joiner

A new hire, agent, or associate needs accounts, devices, and access ready for a start date.

Included pattern: Creating accounts and licences, provisioning or reassigning a device, and granting the access a named role pattern calls for.
Required inputs: An authorized start date, the role or template it maps to, and confirmation of device and licence assignment.
Explicit exclusions: Deciding what role or access level a new hire should have - that decision belongs to the client, provided in advance.

Lifecycle stage

Mover

An existing user changes role, department, location, or employment status.

Included pattern: Adjusting licences, group membership, and access to match the new role, and removing what the old one no longer needs.
Required inputs: The new role or template and an explicit note on what should be removed, not only what should be added.
Explicit exclusions: Assuming a promotion or transfer implies broader access than the client has actually approved.

Lifecycle stage

Leaver

A departure - planned or not - needs access removed on a specific, sometimes very short, timeline.

Included pattern: Disabling access, reassigning or holding licences and data per an agreed policy, and retrieving or wiping a managed device.
Required inputs: An authorized departure date and time, a data-retention decision, and confirmation of who collects the device.
Explicit exclusions: A same-day request with no authorized requester on file - that returns as an exception, not a silent best effort.

Boundary table

Four questions a recurring lane needs answered before it can absorb them.

Question	Why the public bands cannot answer it	Where it gets answered
Who is authorized to request a lifecycle change?	An unverified request to disable or grant access is a real risk, not a formality.	Named in the identity and communication rules, same as any other request.
What happens to a leaver's mailbox and files?	Retention depends on the client's own policy and, sometimes, a legal or regulatory hold.	Set as a data-retention decision before the first leaver request, not during it.
How fast must an offboarding request complete?	Same-day and multi-week timelines are different services with different staffing implications.	Written into the service boundary record as a response expectation.
Does this include HR or payroll system integration?	Automated lifecycle triggers depend on a specific HR platform this catalogue does not assume.	Scoped separately if a client's HR system can trigger requests directly.

Representative pattern

The lane should not care whether the trigger is happy or urgent.

The request arrives through the authorized channel with a role, date, and requester name.
It is checked against an existing role template or, for a leaver, a retention and device-return policy.
Accounts, licences, devices, and access change inside the agreed pattern.
Anything outside the pattern - an unusual access level, an unclear retention call - returns to the named owner.
A completion record shows what changed, what remains open, and what the client was told.

This is a process description, not a claim about a specific client's current turnover rate.

Agent turnover at a brokerage is one of the clearest recurring examples →

New-associate onboarding at a law firm is another →

A leaver's access does not remove itself - see how ongoing identity administration connects →

Related decision

A leaver's device does not walk itself back either.

Device retrieval, wipe, and reassignment follow the same enrolled-and-visible logic as any other endpoint request.

Review the endpoint management lane

Bring one joiner and one leaver pattern.

A typical new-hire checklist and a typical departure checklist are enough to test whether this lane fits the catalogue.

Discuss a user lifecycle lane