# Building Identity Governance Lifecycle Process

> Builds comprehensive identity governance and lifecycle management processes in Azure Entra ID, including JML (Joiner-Mover-Leaver) automation and periodic access reviews.

- Skill: `owasp/building-identity-governance-lifecycle-process` (Agent Skill)
- Install (CLI): `npx skillmds@latest add owasp/building-identity-governance-lifecycle-process`
- Raw SKILL.md: https://api.skillmd.com/api/skills/owasp/building-identity-governance-lifecycle-process/raw
- Safety review: pending
- Works with: Claude Code, Claude.ai, OpenAI Codex
- Category: DevOps & Infra
- License: Apache-2.0
- Author: OWASP (https://skillmd.com/u/owasp)
- Updated: 2026-09-17
- Page: https://skillmd.com/skills/owasp/building-identity-governance-lifecycle-process

---


# Building Identity Governance & Lifecycle — Azure Focused

## When to Use
- When automating the onboarding and offboarding of users in an Azure tenant.
- When configuring Entra ID Governance features like access reviews and entitlement management.
- When establishing a "birthright" access model for new employees based on job code.
- When auditing orphaned accounts belonging to terminated users.

## Key Concepts

| Term | Definition |
|------|------------|
| JML | Joiner-Mover-Leaver, the core lifecycle of an employee identity |
| Birthright Access | Permissions automatically granted to every user in a specific group or department |
| Access Review | Periodic process where managers certify that their employees still need specific permissions |
| Orphaned Account | A valid account in a system that no longer corresponds to an active employee |

## OpenShield Identity Rules

| Rule | Description | Severity |
|------|-------------|----------|
| AZ-IDN-007 | Active User with No MFA Registered in Entra ID | HIGH |
| AZ-IDN-003 | Unrestricted Guest Invitations Allowed in Entra ID | MEDIUM |
| AZ-IDN-006 | Service Principal Secrets Not Rotated Recently | MEDIUM |

## Lifecycle Workflow

### Step 1: Define Joiner Process
Automate account creation via HR feed integration (e.g., Workday to Entra ID).

### Step 2: Implement Access Reviews
Configure quarterly reviews for high-privilege roles like Global Administrator.

### Step 3: Offboarding (Leaver)
Ensure accounts are disabled immediately upon HR status change.

## Remediation Reference
- **Use PIM**: Implement Privileged Identity Management for just-in-time elevation.
- **Automate Termination**: Use Entra ID Lifecycle Workflows to trigger access revocation.
- **Audit Guests**: Regularly review and remove guest users who haven't signed in for 90+ days.