Identity & Access Management · Lesson 5 of 8
Handling role changes
A transfer is both an addition and a removal decision. Giving a person the new role without reviewing the old one creates access accumulation.
A transfer has three decisions
Maya moves from finance to support.
| Existing or new access | Decision | Reason |
|---|---|---|
| Payment approval | Remove | No longer justified unless a specific approved exception applies |
| Shared employee resources | Retain | Still needed in the new role |
| Support ticket access | Add | New approved job requirement |
Read the visualWhat goes wrong if you only add the support group?
Old permissions may remain and accumulate across transfers.
Compare old and new needs
Identify access to retain, add, and remove. Include direct grants and group-based access.
Coordinate the transition
Confirm the effective date and any approved overlap. Record temporary access with an expiry.
Verify the result
Check effective access in relevant applications rather than assuming a group change reached every system.
Put it in context
Maya moves from finance to support. She needs ticket access; payment approval should be removed unless an authorized, time-limited exception exists.
A mover needs an access comparison, not just more permissions.
Read the sources
Make it stick.
Try one short question to check your understanding and save this lesson to your progress.