Microsoft 365 Identity Lifecycle Governance: How to Control Joiners, Movers, Leavers, Guest Access, and Permission Creep

Microsoft 365 access risk often builds gradually through poor lifecycle control, stale permissions, unmanaged guest access, and weak offboarding. Identity lifecycle governance is the practice of managing a user’s access from the moment they join an organisation until they leave, so permissions stay aligned with their current role and business need.

Strong authentication is essential, but an enabled account is not automatically a well-governed account. Without structured lifecycle controls, environments tend to drift into “permission creep”, where users accumulate excessive, stale, or conflicting access rights that broaden exposure and make compliance harder to manage.

How Access Risk Builds Over Time

Identity risk in Microsoft 365 rarely stems from a single configuration error. Instead, it is the result of repeated process gaps across the user lifecycle. When permissions are granted faster than they are reviewed or removed, the environment becomes increasingly difficult to audit and secure.

This issue extends beyond standard employee accounts to include guest users, service accounts, and shared resource memberships. As seen in the governance of privileged access, the goal is not merely to grant access, but to ensure that access is deliberate, time-bound, and strictly necessary. When access is not reviewed and cleaned up properly, the security risk of an organisation grows not because of new software vulnerabilities, but because old user permissions remain in place long after they should have been removed.

The Joiner-Mover-Leaver (JML) Framework

Effective governance relies on a repeatable framework that addresses the three primary stages of the identity lifecycle. Managing these transitions ensures that access is provisioned accurately, reviewed periodically, and revoked immediately.

Joiners: Provisioning for Least Privilege

Onboarding should be a structured process where access is determined by role rather than ad hoc requests. When access is granted through manual, one-off permissions, it creates an immediate lack of visibility. This is often where the seeds of future permission creep are sown.

Governance at the “Joiner” stage requires:

• Role-Based Access Design: Assigning permissions based on defined job functions (e.g., Marketing, Finance, Engineering) rather than individual names.
• Birthright Access: Establishing the minimum set of tools a user needs on Day 1 to be productive, ensuring no excessive “just in case” permissions are granted.
• Group-Based Provisioning: Using security or Microsoft 365 groups to manage access. This allows for easier auditing than assigning permissions to individual user objects.
• Standardised Onboarding: Ensuring that every new identity starts with a baseline that adheres to the principle of least privilege.

Movers: The Point of Greatest Accumulation

Role changes and internal transfers are major governance failure points. Typically, users are granted the new permissions required for their new role, but their legacy access is rarely revoked. This creates “historical role residue,” where a long-tenured employee retains access to sensitive financial, HR, or project data from several previous positions.

Movers are one of the primary sources of permission creep because provisioning is often additive-only. To manage this risk, organisations require:

• Triggered Access Reviews: A mandatory review of all existing permissions whenever a user’s role, department, or manager changes.
• Removal of Legacy Memberships: Ensuring that memberships in security groups and distribution lists associated with previous roles are systematically revoked.
• Business-Owner Validation: Requiring the owner of the new role’s data to validate any legacy access the user claims they still need.
• Temporary Retention Documentation: If access must be retained during a handover period, it should be documented with a firm expiry date rather than left indefinitely.
• Avoiding Additive Provisioning: Ensuring that new access is not simply layered on top of old permissions without evaluation.

Permission Creep Accumulation Model

Leavers: Comprehensive Offboarding

Offboarding must go beyond simply disabling an account in Entra ID (formerly Azure AD). A complete “Leaver” process ensures that no lingering access risk remains. Incomplete offboarding is a primary contributor to gaps in incident response readiness, as stale accounts can be exploited if their credentials are compromised or if session tokens remain valid.

A robust leaver process includes:

• Session and Token Termination: Revoking active refresh tokens to ensure immediate disconnection across all devices.
• Group and Membership Removal: Cleaning up distribution lists and security groups to prevent data from being sent to inactive mailboxes.
• Ownership Handover: Identifying and transferring ownership of SharePoint sites, Teams, or Power Automate flows to prevent orphaned resources that no one can manage.
• Third-Party Integration Review: Ensuring the identity is removed from connected SaaS applications that rely on Microsoft 365 for single sign-on (SSO) authentication.

Managing Guest Access and External Identities

Microsoft 365 facilitates seamless external collaboration, but this convenience often leads to unmanaged guest sprawl. Guest accounts frequently stay in an environment long after a project has concluded because there is no clear ownership or expiration policy.

Unmanaged guests represent a significant governance blind spot. If a guest user’s own environment is compromised, the attacker may gain a foothold in your environment through the lingering guest account. Governance controls for guests should include:

• Business Justification: Requiring an internal sponsor for every guest account.
• Access Reviews: Periodic prompts for sponsors to attest that a guest still requires access.
• Expiration Policies: Automatically disabling or deleting guest accounts after a set period of inactivity (e.g., 90 days).

The Mechanics of Permission Creep

Permission creep is often an operational byproduct rather than a malicious act. It is the result of ongoing operational changes. It develops through:

• Group Nesting: Users inheriting permissions through complex, multi-layered group memberships that are difficult to visualise and audit.
• Ad Hoc Sharing: Direct file and folder sharing that bypasses standard group-based controls, often leading to sensitive data being accessible to “Everyone except external users.”
• Manual Exceptions: Temporary access granted for a specific task that is never revoked because there was no “end date” defined at the time of the request.

Over time, this sprawl makes it nearly impossible to answer the fundamental governance question: “Who has access to this data, and why?”

Why Conditional Access is Not a Lifecycle Solution

It is a common misconception that Conditional Access policies solve identity governance. While Conditional Access evaluates the conditions of an access attempt (such as location, device health, and MFA status), it does not evaluate the entitlement itself.

If a user has inherited legacy permissions to a sensitive SharePoint folder they no longer need, Conditional Access will allow them in as long as they meet the security criteria. Conditional Access strengthens the front door, but identity lifecycle governance ensures the user shouldn’t have a key to that specific room in the first place.

Core Governance Controls

To maintain a secure Microsoft 365 management, organisations should implement the following practical control principles:

• Role-Based Access Design: Defining standard access profiles based on job function rather than ad hoc requests.
• Group-Based Provisioning: Using security or Microsoft 365 groups to manage access, avoiding user-by-user permission sprawl.
• Documented JML Process: Maintaining clear, written procedures for how identities are provisioned, transitioned, and deprovisioned.
• Clear Ownership of Access Decisions: Ensuring that business owners—not just IT—are responsible for approving and reviewing access to their data.
• Periodic Access Reviews: Conducting scheduled audits of high-risk groups and administrative roles to validate necessity.
• Guest Access Governance: Implementing a guest review process where every external account has an internal owner and a defined lifecycle.
• Removal Discipline: Ensuring equal operational focus on the removal of permissions as is placed on the initial provisioning.
• Logging and Audit Visibility: Using Microsoft 365 logging to support investigation and verify that lifecycle processes are being followed.

Access Review and Removal Governance Loop

Warning Signs of Weak Lifecycle Control

Organisations should monitor for these indicators that their identity lifecycle controls are failing:

• Orphaned Accounts: Former staff still appearing in internal groups, Teams, or automated workflows.
• Excessive Guest Counts: Having more guest identities than internal staff identities without a clear business reason.
• Role Inconsistency: Users retaining access to departmental data (e.g., Finance) months after transferring to a different division (e.g., Sales).
• The “Copy User” Workflow: IT staff onboarding new employees by “copying” a similar user’s permissions, which replicates and scales existing permission errors.
• Unknown Resource Owners: SharePoint sites or Teams where the original creator has left, and no current employee is responsible for managing access.

Implementation Approach

For organisations operating within Microsoft 365, the path to better governance should be pragmatic and risk-based. You do not need to redesign every permission model simultaneously.

1. High-Risk Data and Sensitive Groups: Conduct an immediate audit of access to financial, payroll, and executive data. Ensure these groups contain only current, authorised staff.
2. Stale Guest Accounts: Identify and remove guest accounts with no sign-in activity in the last 90 days. Require internal sponsors for all active guests.
3. Formalised Offboarding: Update the “Leaver” process to ensure immediate token revocation and removal from all security groups.
4. Mover-Related Access Review: Implement a policy requiring a full permission review for any staff member changing departments.
5. Gradual Transition: Progressively move away from ad hoc direct permissions toward a group-based model aligned with business services.

Conclusion

Identity lifecycle governance is an ongoing operational discipline rather than a one-time technical project. By implementing structured controls through expert Microsoft 365 management, businesses can prevent the accumulation of risk and ensure their environment remains secure and compliant. If you need assistance with your security strategy, feel free to contact us.