Employee Onboarding and Offboarding Workflow: A Complete JML Guide
Learn how to design a reliable joiner-mover-leaver (JML) workflow that automates HR-to-IT handoffs, provisions access, recovers assets, and measures Day 1 readiness and access revocation.
WorkVerge Team
IT Operations · IT Asset Management · Identity and Access Management · Workflow Automation
October 16, 2026 · 5 min read
Share this article
TL;DR
One workflow, two directions: onboarding and offboarding work best as a single joiner-mover-leaver (JML) workflow driven by the same HR record and the same asset and access inventory.
The trigger is where most workflows break: only 36% of HR leaders in Enboarder's 2025 survey described the handoff between recruiting, HR and hiring managers as seamless.
Movers are the forgotten third: role changes usually add access without removing any, which is how permissions quietly accumulate.
The stakes are real on both ends: 22% of workers have left a job within 90 days, and the human element is involved in roughly 60% of breaches according to Verizon's 2025 DBIR.
Measure outcomes, not task completion: Day 1 readiness, time to revocation and asset recovery rate tell you far more than a ticked checklist.
WorkVerge: HRIS-triggered workflows provision and revoke devices and access against the live asset graph, logging the evidence as they run.
I've come to believe that most onboarding and offboarding problems aren't really checklist problems. Teams usually know what needs to happen on someone's first day and on their last. What goes wrong is the workflow around the checklist: the start date that reaches IT three days late, the laptop that ships without the right apps, the contractor whose access outlives their contract by six months.
The stakes have also become harder to ignore. Enboarder's 2025 survey of 1,000 HR leaders found that 61% saw early attrition rise over the previous year. On the other side of the employee lifecycle, every account that stays active after someone leaves is exposure that nobody is watching. We've written about that in detail in why ghost access is your biggest security threat.
If you're looking for the step-by-step task lists, our IT onboarding checklist and IT offboarding checklist cover them phase by phase. This guide sits one level above those lists. It's about how to design the employee onboarding and offboarding workflow itself, so that the checklists actually get completed, on time, every time, as your organization grows.
Why Are Onboarding and Offboarding One Workflow?
Onboarding grants things: a device, accounts, licenses, group memberships, physical access. Offboarding removes those same things. When the two are designed by different people, owned by different teams and tracked in different places, there's nothing guaranteeing that everything granted on the way in gets recovered on the way out.
That's why we encourage teams to think in terms of a single joiner-mover-leaver (JML) workflow. The same HR record drives every stage, and the same asset and access inventory records what was granted. Offboarding then works from a known list rather than from someone's memory of what a person probably had.
Joiner
Grant, then verify
"Is this person ready to work on Day 1?"
Triggered by a confirmed hire in the HRIS. Provisions a device, identity, role-based access and licenses, then confirms they actually work before the start date.
Leaver
Revoke, then recover
"Is everything we granted now accounted for?"
Triggered by a termination or contract end date. Revokes identity and app access, transfers data ownership, recovers devices and reclaims licenses for reuse.
The inventory is what connects the two
A JML workflow is only as reliable as the record of what each person holds. If devices, SaaS seats and access grants are tied to the employee record as they're issued, the leaver workflow can simply reverse them. If they aren't, offboarding becomes an investigation.
The HR-to-IT Trigger: Where Most Workflows Break
In our experience, the single most common failure point is the very first step: IT finding out that someone is joining, moving or leaving. Even with the best intentions, a trigger that depends on a person remembering to send an email will eventually be late.
Make the HRIS the source of truth
The most dependable pattern is to let the HR system of record start the workflow automatically. A confirmed hire, a change of manager or a termination date in your HRIS (BambooHR, for example) creates the JML event, and IT works from that rather than from a forwarded message. Only 36% of HR leaders describe the handoff between recruiting, HR and hiring managers as seamless, so removing a manual hop at this stage tends to pay off quickly.
Agree on lead times
Devices need to be ordered, imaged and shipped, especially for remote hires. We've found that agreeing a minimum lead time (often ten working days for a standard laptop) and flagging any hire inside that window as an exception is far more effective than trying to make every last-minute start date work.
Treat contractors as first-class records
Contractors and temporary staff often sit outside the HRIS, which means they also sit outside the trigger. Giving them a record with a mandatory end date, even in a lightweight form, is what makes automatic expiry of their access possible.
Movers: The Forgotten Third of JML
Joiners and leavers get attention because they're visible. Movers, the people who change team, role, location or manager, are much quieter, and that's exactly why they cause trouble. A new role almost always comes with new access. It rarely comes with the removal of access the person no longer needs.
Over a few years that accumulates. A long-tenured employee who has moved through finance, operations and product may hold access to all three, long after any of it was justified. The 2025 Verizon Data Breach Investigations Report found the human element involved in around 60% of breaches, and excess access widens what any single mistake or compromised account can reach.
A simple rule that helps
Treat every role change as a partial leaver event followed by a partial joiner event. Access tied to the old role is removed, or explicitly re-approved, before access for the new role is granted. Pairing this with regular software access reviews catches whatever slips through.
Designing the Onboarding and Offboarding Workflow in Four Phases
There's no single correct design, but the structure below reflects what tends to hold up for mid-market and enterprise teams. It applies in both directions: the joiner version grants and verifies, and the leaver version revokes and recovers.
Phase 1
Trigger and plan
T-minus 10 days
The HRIS event creates the JML record with role, department, manager, location and start or end date. Role-based templates decide which device, apps and groups apply, so IT isn't making those decisions from scratch for every hire.
Phase 2
Provision or revoke
T-minus 5 days to Day 0
For joiners, the identity is created in your identity provider (Okta or Entra ID, for example), the device is enrolled through MDM (Jamf or Intune) and licenses are assigned. For leavers, identity is suspended at the agreed time, sessions are ended and app access is removed. Each action is linked back to the employee record.
Phase 3
Verify
Day 0 to Day 1
Verification is the step most workflows skip. For joiners, confirm the device is enrolled and that the person can sign in to core apps before their first morning. For leavers, confirm that no active sessions or tokens remain. A short Day 1 or exit check-in with the employee often surfaces issues that system checks miss.
Phase 4
Recover and record
Day 1 to Day 30
For leavers, devices are recovered, wiped and returned to stock, and freed licenses go back into the pool. For both directions, the record of what happened, who approved it and when becomes audit evidence automatically, rather than something assembled later.
Much of this can be automated, though we'd suggest starting with the trigger and the identity steps before automating everything else. Our guide to IT workflow automation best practices covers how to sequence that.
The Cost of Getting JML Wrong
The figures below come from different sources and measure different things, but together they show why both ends of the workflow deserve attention.
Finding | Source | What it means for JML |
|---|---|---|
61% of HR leaders saw early attrition rise over the past 12 months | Enboarder, 2025 | A rough first week has real retention consequences, and IT readiness is part of that first week |
Only 36% describe the recruiting, HR and manager handoff as seamless | Enboarder, 2025 | Automating the HR-to-IT trigger removes one of the least reliable handoffs |
22% of workers have left a job within their first 90 days | Insight Global, 2025 | Joiner workflows need to deliver a working setup before Day 1, not during the first week |
The human element is involved in about 60% of breaches | Verizon DBIR, 2025 | Leftover and excess access increases the impact of any single mistake |
Third-party involvement in breaches doubled to about 30% | Verizon DBIR, 2025 | Contractor and vendor accounts need end dates and the same leaver workflow as employees |
Sources: Enboarder 2025 HR Leader Survey (1,000 HR leaders), Insight Global 2025 Employee Sentiment Report (905 US workers), and the Verizon 2025 Data Breach Investigations Report.
What Should a Good JML Workflow Measure?
A checklist tells you whether tasks were ticked. It doesn't tell you whether the employee could actually work on Day 1, or whether a leaver's access was really gone by the end of their last day. We'd encourage teams to track a small set of outcome measures instead.
Measure | What it tells you | A reasonable aim |
|---|---|---|
Day 1 readiness rate | Share of new hires with a working device and core access on their first morning | Close to every hire, with exceptions explained |
Time to full revocation | Time from HR termination to the last access being removed | Same day for standard leavers; immediate for sensitive exits |
Asset recovery rate | Share of leaver devices returned within 30 days | Trending upward quarter on quarter |
Orphaned accounts | Accounts with no active owner found during access reviews | Falling with each review cycle |
Hands-off completion rate | Share of JML events completed without manual intervention | Rising as automation matures |
The aims are directional. What matters most is the trend over time and the reasons behind each exception.
Where to Go From Here
The most useful shift is to stop thinking about onboarding and offboarding as two separate checklists. Designed as one JML workflow, driven by the HR record and anchored to a reliable inventory of what each person holds, they reinforce each other. Movers deserve the same discipline, and outcome measures will tell you far more than task completion ever can.
If you'd like to explore how other IT teams are approaching JML, the wider employee lifecycle from hire to retire is a good next read. We share practical guidance like this regularly, so subscribe to the WorkVerge newsletter if you'd like it in your inbox. We're always glad to hear what's working for your team.
How WorkVerge Runs Onboarding and Offboarding Workflows
WorkVerge treats joiners, movers and leavers as events on the same asset graph that holds every device, application and access grant, so the leaver workflow always knows exactly what to reverse.
HRIS-triggered workflows: a hire, role change or termination in your HR system starts the workflow automatically, with role-based provisioning for devices, apps and access.
MDM and identity integrations: device enrollment through Jamf and Intune, and identity provisioning and revocation through Okta and Entra ID, are steps in the same workflow rather than separate tasks.
Employee and asset linkage: every device and license is tied to the employee record as it's issued, so recovery and license reclamation work from a complete list.
Evidence as a byproduct: every workflow step is logged with approver and timestamp and can be replayed, giving auditors provisioning and revocation evidence without manual assembly.
Day 7 and Day 30 check-ins: short onboarding surveys connected to the asset record surface setup problems while they're still easy to fix.
For the full task lists behind each phase, see our IT offboarding checklist.
See how a JML workflow tied to a live asset graph makes Day 1 readiness and same-day revocation the default.
No credit card required · Full platform access · Live in under 2 weeks
Related Articles
IT Onboarding Checklist 2026: What Day-1 Readiness Actually Requires
IT Offboarding Checklist 2026: Recover Assets, Revoke Access, Close Risk
Why Ghost Access Is Your Biggest Security Threat
Software Access Reviews: How to Run Them Without Spreadsheets