IntegrAuth Academy
Identity, security and practical AI — free, from zero. Byte-sized lessons, real diagrams, hands-on labs, zero fluff. Two programs, each with its own exam and certificate.
English is hard? Your browser can translate this page into Tamil, Telugu, Kannada, Malayalam or Hindi. Tech words stay in English so you learn the real names.
How?
- Chrome on phone: ⋮ menu → Translate
- Chrome on computer: right-click → Translate to …
- Edge: the translate icon in the address bar
The lifecycle — joiner, mover, leaver
People join a company, change jobs and leave. Their access must change with them. JML (joiner, mover, leaver) means keeping access in step with a person's real status, automatically. Your goal: name the lifecycle words and say why old access is dangerous.
- Access is easy to give and hard to take back.
- Joiner gets access. Mover changes it. Leaver loses all of it.
- Changes should start from a trusted event, not a ticket.
- Old access left behind is an open door.
Priya's three moments
Joiner · day one
Priya joins Support. On the first morning she needs a login, email and the support tool. If she must wait for tickets, she sits idle for days.
Mover · new role
A year later she moves to Finance. She gets the payment tool. The support tool must go away. If it stays, her powers just pile up.
Leaver · last day
Priya resigns. By evening all her access must be off. One account left on is an open door for anyone who finds its password.
a gate pass at a housing society. A tenant moves out, but the pass still opens the gate. Nobody notices until something goes missing. An orphaned account is that old gate pass.
Words for giving and taking away
| Term | Plain meaning |
|---|---|
| Provisioning / deprovisioning | Creating accounts and giving access, and later removing them. JIT provisioning (just-in-time) makes the account when it is needed. The bad way is lazy provisioning: the account syncs only at the first login. So nothing works on day one. A failed sync is not retried. And name changes never reach the copies. |
| Birthright access | Access you get automatically for who you are, such as "every shop employee gets the roster app". Policy decides, so no ticket is needed. |
| Access package | A ready-made bundle of access for a job. You request and approve it as one unit. Entitlement management runs these catalogs. |
| Access review | A human owner regularly confirms: "yes, these people (and bots) still need this access". It fights privilege creep, where access piles up over the years. |
| Orphaned account | An account whose person has left, moved or never existed. Attackers love it. |
| Delegated administration | A partner's own manager runs their staff's access, inside limits we set. Our help desk does not have to. |
| SoD (segregation of duties) | No one person (or bot) holds a dangerous mix of powers. Whoever adds a supplier must not also approve payments to it. The system must enforce this. A written rule is not enough. |
Staff at partner stores change jobs fast. Sam might quit by text message. So a modern program needs event-driven sync from partner rosters. Each change arrives in real time. Overnight batch jobs are too slow. A mover's access is recalculated in minutes. A leaver loses everything the same day.
An orphaned account or an old "mover" permission is a door left open after the person has gone. JML keeps the open doors at zero.
🧪 Interactive lab — enable JavaScript to play with this one.
Automating joiners, movers and leavers usually uses SCIM v2 (RFC 7644) and event streams. Want a hand? Talk to our team.