Provisioning & Deprovisioning Lifecycle
AOH Sync tracks four lifecycle events — Joiner, Mover, Leaver, and Reactivation — that together cover every significant change to a person's relationship with your organization.
Lifecycle events are tracked at the Identity level, not per individual account. When a change comes from one source record, the event is still recorded against the person — not against that record alone.
The four events
Joiner
A Joiner event occurs when a new Identity appears in your Source Systems for the first time. AOH Sync detects the new record, creates the corresponding Identity, and provisions an account in Microsoft Entra ID according to your configured attribute mappings and group assignments.
Typical result: a new Entra account is created and the user can sign in.
Mover
A Mover event occurs when an existing Identity's attributes change in a meaningful way — a department transfer, a title change, a change in reporting structure. AOH Sync detects the difference between the current state and the previous state, updates the Entra account accordingly, and adjusts group memberships or application access if your mappings are configured to respond to those changes.
Typical result: the existing Entra account is updated; access reflects the person's new role.
Mover events are where excess access tends to accumulate: new access is granted for the new role, but access from the old role may not be removed unless your mappings are configured to do so. Review your attribute mappings and group assignment rules to ensure old access is cleaned up on role changes.
Leaver
A Leaver event occurs when all of an Identity's login-capable accounts become disabled or are staged for disablement — typically because the person has left the organization. AOH Sync disables or removes the corresponding Entra account based on your deprovisioning policy.
Typical result: the Entra account is disabled, revoking sign-in access.
AOH Sync disables Entra accounts on Leaver events by default. Permanent deletion depends on your configured deprovisioning policy. Review your policy before go-live to avoid accidental data loss.
Reactivation
A Reactivation event occurs when a previously inactive Identity becomes active again — for example, a returning employee or contractor. This is distinct from a new Joiner: the person's history remains intact, and any access that was previously attached may still need to be reviewed before it is restored.
The full lifecycle in order
Why transitions, not just snapshots
AOH Sync records the transitions — not only the current state — so that you always have a clear answer to accountability questions. "This person left on this date and these accounts were still active" is only answerable if the leaving was recorded as an event. Lifecycle events feed the audit trail and ensure you can demonstrate a complete, auditable picture of every person's access history.
Where to see lifecycle events
You can review lifecycle history for any Identity from the Identities screen — open an Identity record and view its event timeline. The Sync History tab on each Connector shows the Joiner, Mover, and Leaver events triggered by that Connector's most recent runs.
Lifecycle events are also surfaced in the Status & Logs section under Administration.
Related
Last updated