Many UK SMEs judge their IT by two familiar measures: how many support tickets are open, and whether the internet is working. Both matter. Neither tells you whether the business knows who can access its systems, why they need access, or whether that access is removed when circumstances change.
Joiners, movers and leavers (JML) make those questions visible. A new starter waiting days for a laptop is an operational issue. A former employee retaining access to business email is a security and governance issue. A role change that adds permissions but never removes old ones is both.
Together, these everyday events provide a useful honesty test: is IT genuinely managed, or is the business relying on people to remember what to do?
Five signs your JML process needs attention
1. New starters wait for the basics
A new employee arrives, but their account is not ready, their device is still being configured, or nobody knows which software they need. Perhaps HR sent an email; perhaps a manager raised a ticket; perhaps neither did.
This is more than a poor first impression. It suggests there is no agreed checklist tying the person’s role and start date to the systems, equipment and access they need. A well-managed process makes preparation routine: the right requests are approved and assigned in time, without granting more access than the job requires.
2. Leavers keep access after they leave
If a departing employee’s email, cloud storage, remote access or line-of-business accounts stay active for days or weeks, the organisation has an ownership gap. Disabling one central account may not remove access to every connected service, particularly when staff have signed up using their work email address.
Offboarding should be coordinated with the effective departure time. It should cover accounts, active sessions, devices, shared credentials and third-party access, while preserving and transferring business records in line with the organisation’s policies.
3. Movers accumulate permissions
A promotion or team move often brings new access. The risk comes when old access stays in place as well. Someone who moves from sales to finance, for example, may retain systems and data access that no longer match their responsibilities.
A role change should prompt a review, not just an addition. Confirm what the person needs in their new role, remove what they no longer need, and pay particular attention to administrator rights, financial approvals and sensitive information.
4. Licence costs drift upwards
When a leaver’s account is disabled but their subscription is not reviewed, the business may keep paying for a seat nobody uses. The same drift occurs when people change roles, teams purchase overlapping tools, or renewals happen without anyone checking actual usage.
This is a Technology Expense Management issue as much as an IT task. Good oversight connects the person, application, business owner, contract and cost, so the organisation can reclaim unused licences and make informed renewal decisions.
5. Everyone assumes someone else owns it
HR may tell the manager. The manager may contact the helpdesk. The helpdesk may be unaware of a separate finance system. An office manager may arrange the laptop but not know about cloud access. Each person does something reasonable; nobody sees the whole lifecycle.
The result is improvisation rather than control. A process needs one accountable owner, clear approval points and a record showing what was completed. That does not mean one person must perform every task. It means responsibility for the outcome cannot be left between departments.
Governance first; execution second
JML is first a governance question: who owns the access lifecycle, what is the standard, who approves exceptions, and how can the business show that the process happened?
Only then is it an execution question. Helpdesk Support, Cloud Solutions and Network Solutions can help deliver account setup, device preparation, access changes and support. They are most effective as bolt-on execution services under an overarching IT strategy, not substitutes for clear ownership.
A simple lifecycle record should connect the request to the person, role, manager, start or change date, systems required, approvals and completion evidence. It should also cover applications outside the central Microsoft environment and access held by contractors or suppliers.
The National Cyber Security Centre’s guidance on identity and access management recommends having a JML policy, controlling access according to need, reviewing privileges and ensuring access can be revoked when no longer required. It also highlights the value of individual accounts, appropriate authentication and audit records.
That is consistent with Cyber Essentials-style access-control expectations: users should have appropriate, individually attributable access, unnecessary accounts should not remain active, and privileges should reflect the work people actually do. Certification is not a substitute for a functioning process. A tidy policy that nobody follows is still just a tidy document.
Where older platforms are part of the estate, they need to be included rather than treated as an exception. This applies to IBM i Management and related access to established business systems: identify who owns administration, how users are approved, what happens when roles change, and how access is removed. A cloud-first strategy does not make legacy access disappear.
Five practical steps to take this quarter
An SME does not need to begin with a large transformation project. Start by making the basics consistent and measurable.
-
Name one owner. Choose a person accountable for the JML process end to end. HR, IT and department managers can each have tasks, but one owner should make sure nothing falls between them.
-
Document one workflow. Write down the steps for a joiner, mover and leaver. Include who raises the request, who approves access, what systems and devices are covered, who completes each task and when it must happen.
-
Review access regularly. Ask managers and system owners to confirm that staff still need their current access. Make the review proportionate to risk and include privileged accounts, finance systems and external users. The NCSC’s identity and access management guidance provides a useful foundation.
-
Reconcile licences and users. Compare your staff list with accounts, subscriptions and invoices. Investigate inactive accounts, unassigned licences and systems with no named business owner. Record reclaimed spend and renewal decisions as part of Technology Expense Management.
-
Keep evidence. Store approvals, completion records, access reviews and exceptions somewhere appropriate and accessible to the people responsible. Evidence helps the business answer straightforward questions during audits, supplier reviews or an incident: who approved the access, when was it changed, and what was checked?
A useful starting set of measures might include whether leaver access was disabled by the agreed time, how many access reviews are overdue, how many unused licences were identified, and how many systems are covered by the workflow. The point is not to create reporting for its own sake. It is to see whether the process works.
Why it matters for Dynamics 365 Business Central
Lifecycle governance is especially valuable when a business uses Dynamics 365 Business Central for finance and operations. Different roles may require different permissions, and a person’s access should change when their responsibilities do. Microsoft’s Business Central user and permissions guidance explains how user accounts, licences and permission sets are managed.
Planning these controls early can make a Dynamics 365 Jump Start more orderly: agree role-based access, approvals and ownership as part of the wider implementation strategy, rather than trying to untangle them after go-live. Licensing and authorisation are related, but they are not the same thing; paying for a licence does not automatically mean a person should have broad access.
Make the process part of the IT strategy
JML is a small operational process with a wide view of how IT is managed. It reveals whether responsibilities are clear, whether access is governed, whether licence spend is reviewed and whether services, from Cloud Solutions to Disaster Recovery and Voice and Connectivity, fit into a coherent operating model.
David’s practitioner-led approach brings strategic IT consultancy together with delivery experience, including multi-national onboarding and Google-certified IT project management. As a Fractal IT Director, he helps businesses define the operating model first, then draw on trusted specialists for the execution work that supports it.
If your onboarding and offboarding depend on memory, this quarter is a good time to make them repeatable. For a broader view of the Evestaff group’s services, visit evestaff.co.uk.
SEO keywords
Cloud Solutions, Disaster Recovery, Dynamics 365 Jump Start, Helpdesk Support, IBM i Management, Managed IT Services, Network Solutions, Technology Expense Management, Voice and Connectivity.
Join The Discussion