This is the backbone. Access control, offboarding risk, audit evidence and half your ticket volume all trace back to whether the lifecycle is a process or a series of favours. It is also the part of the job that scales worst if you get it wrong: at 500 people you can survive doing it by hand, at 1500 you cannot.
Start from the trigger, not from the task
The single decision that determines whether this works is where the process starts. If it starts from an email or a ticket to IT, it will be inconsistent, because it depends on somebody remembering. If it starts from the HR system as the system of record, it is reliable, because the business already has to update HR for payroll to work.
That has a corollary worth saying out loud in an interview: if a population is not in the HR feed, it will not be handled. Contractors are the usual gap, and the failure mode is not a bad offboarding, it is no offboarding at all because nobody told IT the engagement ended.
Joiner
The goal is that a new starter can work on day one without raising a ticket. Create the account to a naming convention, place it in the organisational unit for its department so policy applies, add it to the groups that carry its access so applications and shared drives follow automatically, apply the signature, provision the Drive folders, assign the licence.
Anything still requiring a human is your list of what to automate next.
Mover, the one everybody skips
Someone changes team. They gain the new group. They keep the old one, because nobody is incentivised to take access away and the person certainly is not going to ask. Repeat over a few years and you have people who can reach almost everything, which is precisely what an auditor goes looking for.
Handle it as a real event: recompute group membership from the new role rather than adding to it, move the organisational unit so policy follows, and reset anything role derived. If you genuinely cannot automate the removal, surface the delta in an access review so a human approves it, which at least makes the accumulation visible.
Leaver, where ordering matters
1. Suspend. First, because it stops the active session and buys you time for everything else.
2. Sign out all sessions, then revoke OAuth tokens and app passwords. This is the step most often missed, and the mechanism is worth knowing. Suspension blocks sign-in, but it does not automatically end active sessions, and it does not revoke third-party OAuth grants: each one stays valid until the application itself checks the account state, which some never do, so a grant can outlive the suspension by weeks. A password change revokes tokens only if you have enabled the automatic revocation setting for it. Do not assume either.
3. Transfer Drive ownership to the manager. Files in My Drive belong to the person and leave with the account; files in a shared drive belong to the drive and need nothing. That difference is the argument for putting team work in shared drives in the first place.
4. Set mail delegation or a forward for the agreed handover period, with an end date on it.
5. Remove from groups, which is where the access actually lived.
6. Reclaim the licence, but only now. Reclaiming before the data moves is how you strand the files you were trying to preserve.
7. Keep the account suspended rather than deleted until the retention period passes.
The point of a fixed sequence is not tidiness. It is that every leaver then looks identical in the log, so an auditor can sample any one of them, and you stop finding the account nobody closed.
Where it goes wrong
Rehires reusing the old account. Convenient, and it silently restores group memberships, shares and delegations from a previous role that nobody is going to audit. Create a new account and transfer deliberately.
Third-party tools outside the lifecycle. Any SaaS product that does not deprovision from your identity source becomes an orphan account the moment somebody leaves. This is the strongest argument for insisting on SSO at procurement rather than after.
Automation with no dry run. A leaver script that half-executes is worse than a manual process, because everybody now assumes it happened.
No expiry on contractor access. Set the end date when the account is created, not when somebody remembers.
The short version
Trigger from the system of record. Joiners are ready on day one without a ticket. Movers recompute rather than accumulate. Leavers follow a fixed order, suspend and revoke tokens first, move data before reclaiming the licence, and every one looks the same in the log. Consistency is what makes it auditable, and auditable is what makes it defensible.