> For the complete documentation index, see [llms.txt](https://docs.aohwv.dev/llms.txt). Markdown versions of documentation pages are available by appending `.md` to page URLs; this page is available as [Markdown](https://docs.aohwv.dev/core-concepts/provisioning-lifecycle.md). # Provisioning & Deprovisioning Lifecycle AOH Sync tracks four lifecycle events — **Joiner**, **Mover**, **Leaver**, and **Reactivation** — that together cover every significant change to a person's relationship with your organization. {% hint style="info" %} Lifecycle events are tracked at the Identity level, not per individual account. When a change comes from one source record, the event is still recorded against the person — not against that record alone. {% endhint %} ## The four events ### Joiner A **Joiner** event occurs when a new Identity appears in your Source Systems for the first time. AOH Sync detects the new record, creates the corresponding Identity, and provisions an account in Microsoft Entra ID according to your configured attribute mappings and group assignments. Typical result: a new Entra account is created and the user can sign in. ### Mover A **Mover** event occurs when an existing Identity's attributes change in a meaningful way — a department transfer, a title change, a change in reporting structure. AOH Sync detects the difference between the current state and the previous state, updates the Entra account accordingly, and adjusts group memberships or application access if your mappings are configured to respond to those changes. Typical result: the existing Entra account is updated; access reflects the person's new role. {% hint style="info" %} Mover events are where excess access tends to accumulate: new access is granted for the new role, but access from the old role may not be removed unless your mappings are configured to do so. Review your attribute mappings and group assignment rules to ensure old access is cleaned up on role changes. {% endhint %} ### Leaver A **Leaver** event occurs when all of an Identity's login-capable accounts become disabled or are staged for disablement — typically because the person has left the organization. AOH Sync disables or removes the corresponding Entra account based on your deprovisioning policy. Typical result: the Entra account is disabled, revoking sign-in access. {% hint style="warning" %} AOH Sync disables Entra accounts on Leaver events by default. Permanent deletion depends on your configured deprovisioning policy. Review your policy before go-live to avoid accidental data loss. {% endhint %} ### Reactivation A **Reactivation** event occurs when a previously inactive Identity becomes active again — for example, a returning employee or contractor. This is distinct from a new Joiner: the person's history remains intact, and any access that was previously attached may still need to be reviewed before it is restored. ## The full lifecycle in order ``` New record in source ──► Joiner ──► Entra account created Attribute change in source ──► Mover ──► Entra account updated All login accounts disabled ──► Leaver ──► Entra account disabled Previously inactive, now active ──► Reactivation ──► Access reviewed and restored ``` ## Why transitions, not just snapshots AOH Sync records the transitions — not only the current state — so that you always have a clear answer to accountability questions. "This person left on this date and these accounts were still active" is only answerable if the leaving was recorded as an event. Lifecycle events feed the audit trail and ensure you can demonstrate a complete, auditable picture of every person's access history. ## Where to see lifecycle events You can review lifecycle history for any Identity from the **Identities** screen — open an Identity record and view its event timeline. The **Sync History** tab on each Connector shows the Joiner, Mover, and Leaver events triggered by that Connector's most recent runs. Lifecycle events are also surfaced in the **Status & Logs** section under Administration. ## Related * [How AOH Sync Works](/core-concepts/how-aohsync-works.md) * [Identities, Accounts & Users](/core-concepts/identities-accounts-users.md) * [Browsing Identities](/feature-reference/browsing-identities/identities.md) * [Sync History](/feature-reference/connectors/logs.md) * [Audit & Status Logs](/administration/audit-and-status-logs.md) --- # Agent Instructions This documentation is published with GitBook. GitBook is the documentation platform designed so that both humans and AI agents can read, navigate, and reason over technical content effectively. Learn more at gitbook.com. ## Querying This Documentation If you need additional information that is not directly available in this page, you can query the documentation dynamically by asking a question. Perform an HTTP GET request on the current page URL with the `ask` query parameter, and the optional `goal` query parameter: ``` GET https://docs.aohwv.dev/core-concepts/provisioning-lifecycle.md?ask=&goal= ``` `ask` is the immediate question: it should be specific, self-contained, and written in natural language. `goal` is optional and describes the broader end goal you are ultimately trying to accomplish on behalf of the user. GitBook uses it to tailor the answer towards what is most useful for that goal. The response will contain a direct answer to the question and relevant excerpts and sources from the documentation. Use this mechanism when the answer is not explicitly present in the current page, you need clarification or additional context, or you want to retrieve related documentation sections.