When this guide is useful
HR, operations and IT teams coordinating staff access across cloud services and business applications
- New starters wait for applications while colleagues share accounts to keep work moving.
- Departed staff still appear active in specialist SaaS tools.
- A role change adds permissions but never removes the previous department's access.
- HR, IT and managers maintain different versions of the same staff list.
Choose the authoritative event and approval route
Identify where a confirmed start, role change or departure is recorded, who can approve it and which time zone applies. Distinguish a draft recruitment record from an instruction to create live access. For urgent departures, establish a verified route that reaches an authorised administrator without depending on an unattended queue.
Define role-based access packages in plain language with the relevant application owners. The package should specify what the role needs, while sensitive access may require an additional named approval. Avoid using another employee's entire access list as the default template; it can copy years of accumulated exceptions into a new account.
Connect identity changes to the applications themselves
Microsoft describes lifecycle workflows around joiner, mover and leaver events, while app provisioning maintains identities in connected services. Single sign-on and provisioning solve different parts of the problem. Check whether each application supports account creation, role updates, suspension and session handling through the integration you intend to use.
Keep a system-by-system matrix for unsupported or partially supported actions. A service may accept login through the central identity provider yet retain local credentials, API tokens or an independent administrator account. Assign manual tasks where automation cannot safely complete the work, and require confirmation from the application owner.
Separate access removal from information retention
For a leaver, specify the point at which access ends and the sequence for central accounts, devices and connected services. Reconcile any delayed provisioning jobs and verify the resulting state in important applications. A successful workflow notification should be supported by an observable access result.
Handle business records, mailbox continuity and file ownership under the organisation's approved retention and privacy rules. Removing access does not automatically require deleting all information, and a manager's request does not automatically justify unrestricted access to a former employee's content. Record the purpose, authority and scope of any delegated access or ownership transfer.
Design for mistakes, contractors and role changes
Test a cancelled start, an incorrect departure date, a returning employee, a contractor extension and a move between departments. Decide how to reverse an erroneous action without reintroducing inappropriate privileges. Use stable identifiers to match people across systems instead of relying only on names that can change or collide.
Review accounts that have no current person, sponsor or service owner. Track missed completion times, manual exceptions and application accounts left behind after central suspension. Use those findings to improve the workflow rather than judging success solely by how quickly the initial account is created.
From diagnosis to delivery
How Britixo can help
Britixo can help connect staff lifecycle events with Microsoft 365, CRM and supported business applications. An agreed scope can include process mapping, identity matching, role rules, integration development and exception reporting. We can work with HR and application owners to make completion visible and to separate access decisions from records-retention decisions. Contact Britixo with the systems involved, the current approval process and the failures you want to remove. Platform capabilities, required licences, processing responsibilities and any sensitive offboarding procedures are agreed before automation is enabled.
Talk through your requirementsCommon questions
Does single sign-on automatically remove application accounts?
No. Authentication and account provisioning are separate. Check how the specific application handles suspension, local credentials, sessions and data ownership.
Should leaver records always be deleted immediately?
Access removal and retention are different decisions. Follow the organisation's applicable retention, privacy and legal requirements, with the appropriate authorised owner.
What should happen when an employee changes role?
Review old access as well as granting the new role's needs. Set an explicit transition period if both roles are temporarily required, then verify its expiry.
Sources and further reading
Use the original documentation to check current product terms, eligibility and technical details.
Published by Britixo on 29 October 2026. How these guides are prepared. Product availability and delivery scope are confirmed for your requirements.