This is the backbone. Access control, offboarding risk, audit evidence and half your ticket volume all trace back to whether the lifecycle is a process or a series of favours. It is also the part of the job that scales worst if you get it wrong: at 500 people you can survive doing it by hand, at 1500 you cannot.
Start from the trigger, not from the task
The single decision that determines whether this works is where the process starts. If it starts from an email or a ticket to IT, it will be inconsistent, because it depends on somebody remembering. If it starts from the HR system as the system of record, it is reliable, because the business already has to update HR for payroll to work.
That has a corollary worth saying out loud in an interview: if a population is not in the HR feed, it will not be handled. Contractors are the usual gap, and the failure mode is not a bad offboarding, it is no offboarding at all because nobody told IT the engagement ended.
Joiner
The goal is that a new starter can work on day one without raising a ticket. The order matters less here than on the leaver side, because nothing is being taken away, but two of these steps are load bearing and are the ones people get wrong.
1. Create the account to a naming convention, decided once and never argued about again.
2. Place it in the organisational unit for its department. The organisational unit is what applies policy, and it is not the same thing as access. The distinction is worth getting straight before you build anything on top of it.
3. Add it to the groups that carry its access, so applications and shared drives follow automatically. Never grant a person access to a resource directly, however quick it looks. That single shortcut is what creates the mover problem below, and you will be untangling it years later.
4. Assign the licence, and the signature, and provision the Drive folders.
5. Enrol the device before it ships, not on the first morning. A laptop that arrives already enrolled is the difference between a new starter working at 9am and a new starter watching a progress bar.
6. Require two-step verification before the first sign-in, not after a grace period. Enrolment is easy while the account is new and nobody has built a habit around not having it.
Anything still requiring a human is your list of what to automate next.
Mover, the one everybody skips
Someone changes team. They gain the new group. They keep the old one, because nobody is incentivised to take access away and the person certainly is not going to ask. Repeat over a few years and you have people who can reach almost everything, which is precisely what an auditor goes looking for.
Handle it as a real event: recompute group membership from the new role rather than adding to it, move the organisational unit so policy follows, and reset anything role derived. If you genuinely cannot automate the removal, surface the delta in an access review so a human approves it, which at least makes the accumulation visible.
Leaver, where ordering matters
One check belongs before any of this, because it is the only step that is painful to undo. Find the shared drives where the leaver is the only manager. A shared drive left with no eligible manager is deactivated within about a day, and its members simply stop seeing it. The files are not lost and an administrator can reinstate a manager, but you will hear about it first from the team whose drive vanished, which is a bad way to find out. Promote somebody while the account is still there.
1. Suspend. First, because it stops the active session and buys you time for everything else.
2. Sign out all sessions, then revoke OAuth tokens and app passwords. This is the step most often missed, and the mechanism is worth knowing. Suspension blocks sign-in, but it does not automatically end active sessions, and it does not revoke third-party OAuth grants: each one stays valid until the application itself checks the account state, which some never do, so a grant can outlive the suspension by weeks. A password change revokes tokens only if you have enabled the automatic revocation setting for it. Do not assume either.
3. Transfer Drive ownership to the manager. Files in My Drive belong to the person and leave with the account; files in a shared drive belong to the drive and need nothing. That difference is the argument for putting team work in shared drives in the first place.
4. Set mail delegation or a forward for the agreed handover period, with an end date on it.
5. Deal with the calendar. Events belong to whoever organised them, so a standing meeting can end up with an owner nobody can reach and a room booked until the end of the quarter. Reassign the recurring meetings that matter and release the resource bookings while the account still exists.
6. Take the device out of management and mark it returned in the inventory. If your mobile device management ties enrolment to the user rather than the hardware, this has to happen before the account goes, or you are left with a laptop that no console will claim.
7. Remove from groups, which is where the access actually lived.
8. Reclaim the licence, but only now. Reclaiming before the data moves is how you strand the files you were trying to preserve. If the account has to stay for retention, an archived user licence is the cheaper way to hold it.
9. Keep the account suspended rather than deleted until the retention period passes. Deletion is reversible for twenty days and not a day longer, and the files the account owned in My Drive go with it. If there is a legal reason to preserve the mailbox, put a hold on it, and be clear with yourself that a hold is retention, not a backup.
The point of a fixed sequence is not tidiness. It is that every leaver then looks identical in the log, so an auditor can sample any one of them, and you stop finding the account nobody closed.
Where it goes wrong
Rehires reusing the old account. Convenient, and it silently restores group memberships, shares and delegations from a previous role that nobody is going to audit. Create a new account and transfer deliberately.
Third-party tools outside the lifecycle. Any SaaS product that does not deprovision from your identity source becomes an orphan account the moment somebody leaves. This is the strongest argument for insisting on SSO at procurement rather than after.
Automation with no dry run. A leaver script that half-executes is worse than a manual process, because everybody now assumes it happened.
No expiry on contractor access. Set the end date when the account is created, not when somebody remembers.
The short version
Trigger from the system of record. Joiners are ready on day one without a ticket, with access through groups and never directly. Movers recompute rather than accumulate. Leavers follow a fixed order: check the shared drives they alone manage, suspend and revoke tokens first, move data before reclaiming the licence, and every one looks the same in the log. Consistency is what makes it auditable, and auditable is what makes it defensible.