SailPoint IIQ Lifecycle Events Explained — Joiner, Mover, Leaver and Rehire in Enterprise IAM

What Are Lifecycle Events in SailPoint IdentityIQ?

Lifecycle events in SailPoint IdentityIQ are configured rules that watch for a change in an identity — joining the company, switching departments, leaving, or being rehired — and automatically launch a business process to grant, change, or remove access in response. They are how IIQ turns an HR event into the right access changes across dozens of connected systems, without anyone raising a manual request.

Lifecycle events are part of the Lifecycle Manager module, and they sit at the heart of what enterprises call JML — Joiner, Mover, Leaver. When Lifecycle Manager is enabled, IdentityIQ ships with four predefined lifecycle events. Importantly, they are disabled by default and must be enabled and configured before they will fire, according to SailPoint's official IdentityIQ documentation. This is Module 12 of the SailPoint Academy curriculum — and one of the modules enterprise interviewers test most often.

Joiner, Mover, Leaver, Rehire — What Each Event Does

The four predefined lifecycle events each detect a different change to an identity and run a different provisioning workflow. Here is what each one does in a real IdentityIQ deployment.

A useful way to remember the distinction: Joiner grants access, Mover adjusts access, Leaver removes access, and Rehire has to reconcile a returning identity against history. To go one level deeper on every IIQ module that surrounds these events, see the full SailPoint IIQ curriculum.

How Are Lifecycle Events Triggered in IIQ?

Lifecycle events are triggered by changes to identity attributes that IdentityIQ detects during aggregation and identity refresh. Each event has a trigger condition — and when an identity newly matches that condition, the event launches its assigned business process.

This is the part practitioners most often misunderstand, so it is worth being precise. The sequence in a typical deployment looks like this:

1. Aggregation pulls fresh data from the authoritative source (usually an HR system like Workday or SuccessFactors) into IdentityIQ.
2. Identity refresh recalculates each identity and compares the new attribute values against the previous state.
3. If an attribute change matches a lifecycle event's trigger — for example status moving from active to terminated — the event fires.
4. The event launches its business process (workflow), which contains the provisioning actions that grant or revoke access.

A trigger can be a simple attribute-change condition or a custom rule for more complex logic. One rule that trips up newcomers: if a single identity matches several events at once, Leaver takes priority over Joiner and Mover — no other event outranks leaver processing. This prevents a returning-then-leaving edge case from accidentally re-granting access to someone exiting.

Birthright Access and the Joiner Event

Birthright access is the baseline set of accounts and entitlements every identity receives automatically based on who they are — department, job title, location, or employee type. In IIQ, birthright access is usually delivered through the Joiner event using birthright business roles, so a new hire has correct day-one access without raising a single request.

For example, a new analyst joining a bank's risk team might automatically receive an Active Directory account, an email mailbox, access to the shared risk drive, and a read-only entitlement in the reporting tool — all assigned the moment the Joiner event detects the new identity. SailPoint's own guidance describes birthright access as the permissions an employee gets "simply because they are employees," typically established through Role-Based Access Control, per the SailPoint Joiner-Mover-Leaver overview.

This is exactly why Role Management (Module 7) and Application Rules (Module 6) are taught before Lifecycle Events in a well-sequenced program — birthright provisioning is the point where roles, rules, and lifecycle events all come together.

The Leaver Event: Why It Is the Highest-Stakes Lifecycle Event

The Leaver event is the most compliance-critical of all lifecycle events because a missed or delayed Leaver leaves an active account in the hands of someone who has left the organisation. By default, the Leaver event creates and runs a provisioning plan that disables all accounts the leaving identity holds across every connected system — not just Active Directory.

Mature deployments usually configure two distinct leaver paths: an ordinary leaver (resignation or retirement, where accounts are disabled then deleted after a grace period) and a termination (immediate, hard cut-off of all access). Getting this separation right is what auditors look for, because orphaned and lingering accounts are among the most common findings in an access audit.

The Rehire Event: The One Most Courses Skip

The Rehire event handles a former employee returning, and it is the most error-prone lifecycle event because it has to reconcile a new HR record against an old identity. The core question Rehire must answer is: do we reactivate the previous identity, or create a brand-new one?

Get this wrong and you either resurrect stale, over-privileged access from the person's previous tenure, or you create a duplicate identity that breaks reporting and certifications. Real practitioners run into exactly these issues — the SailPoint Developer Community has active threads on rehire-joiner conflicts where the leaver and joiner logic collide. Rehire forces you to combine three concepts: identity correlation, leaver cleanup, and joiner birthright provisioning.

Most short crash courses skip Rehire entirely because it is harder to teach. SailPoint Academy keeps it in the curriculum precisely because it separates someone who memorised definitions from someone who can actually design a lifecycle flow.

Classic Lifecycle Events vs Rapid Setup

There are two ways to configure lifecycle events in modern IdentityIQ — the classic manual approach and the newer Rapid Setup framework — and knowing both matters because Indian enterprises run a mix of legacy and newer deployments.

Rapid Setup pre-builds Joiner, Mover, and Leaver processes with a guided, slider-driven configuration, letting teams stand up JML faster with far less custom code. Classic configuration gives you full control when requirements are complex. A job-ready professional should be comfortable with both — and that is how a complete program teaches it.

How Lifecycle Events Connect to the Rest of the IIQ Curriculum

Lifecycle events are Module 12, but they only work because of the modules around them — which is why learning them in isolation rarely produces interview-ready understanding. Here is how the SailPoint Academy curriculum sequences the dependencies.

This dependency map is exactly why the full 14-module program runs over 2 months rather than a two-week crash course. You can read about how the modules build on each other in our SailPoint online training guide.

Why BFSI GCCs in India Care So Much About Lifecycle Events

For Indian enterprises — especially banking, financial services, and insurance GCCs — lifecycle automation is not a nice-to-have, it is a regulatory requirement. Three frameworks make automated JML mandatory rather than optional.

Because a leaver that does not fire is an audit finding waiting to happen, enterprises invest heavily in professionals who can design and troubleshoot lifecycle events. This regulatory pressure is a big reason SailPoint demand in India stays resilient even when broader IT hiring slows. For where this skill leads career-wise, see our SailPoint IAM career paths guide, and for city-specific hiring context, the Hyderabad and Bangalore training pages.

Common Interview Questions on Lifecycle Events

Lifecycle events are one of the most heavily tested IIQ topics in technical interviews, because they prove you understand provisioning end to end. These are the questions that come up most often:

For a broader question bank across all 14 modules, see our SailPoint IIQ interview questions guide.