When an employee transfers teams, compare their existing access with the access required for the new role.
Adding the new permissions is only half the decision. Old permissions may need removal, temporary retention, or explicit review by an owner.
Use a before-and-after record to make those choices visible. This is a practical governance exercise because it connects the employee's work with technical changes and approvals. A completed request for the new application doesn't tell you what happened to the old department's resources.
Start with the new role's actual work
Do not begin by copying the access of a convenient colleague.
In a fictional transfer, the employee may need to view invoices but not approve payments. Another finance employee may have broader responsibilities and therefore a different access set.
Identify the resources and actions required for the new job. Ask the appropriate owner to confirm them.
A job title or department name can help organize the request, but it does not replace an access decision. The more sensitive the action, the more important the distinction becomes.
Classify each existing and requested entitlement
Create a list covering old-team resources, new-team resources, and shared applications. Give each item an explicit decision:
| Decision | Meaning |
|---|---|
| Add | Approved access is needed for the new responsibilities |
| Retain | Existing access remains justified |
| Remove | The previous business need no longer applies |
| Review | An owner must resolve uncertainty before you assume the access should remain |
Record the reason and relevant owner rather than relying on an unexplained group list.
Microsoft's access-review overview describes the broader practice of checking whether access still belongs. A lab can demonstrate the reasoning at a much smaller scale.
The purpose of the list is to make accidental retention visible. You don't need a complicated platform before you can explain that decision process.
Treat temporary overlap as an exception with an end
Sometimes the employee needs old access briefly to complete a handoff. That can be a legitimate requirement.
Record the reason, the owner who approved it, the scope, and the expiration or review date. “Keep the old access for now” is not a complete decision.
In your fictional scenario, the employee might retain read-only access to a purchasing archive for a limited transition period while losing the ability to create new orders.
That example demonstrates a deliberate compromise instead of treating every move as either full retention or immediate removal of everything.
Verify both the new access and the removed access
Test the intended new task. Then test that the old task is no longer available under the appropriate session conditions.
A successful finance login does not prove the purchasing permission was removed. A changed group list does not prove every application has reflected the change.
Keep your conclusion specific to the systems you tested. Identify any manual follow-up or application behavior that remains outside the lab.
Designing positive and negative access tests helps turn the transfer record into evidence rather than an administrative checklist.
Include a check for separately managed applications. A directory group change may not cover a local application account or a manually assigned role. Your scenario should identify which systems are connected to the change and which require a separate verified action.
Capture the decision trail for the next reviewer
A useful record includes the transfer event, the intended permissions, the approvals, the implementation, and the verification.
The next person should not need to reconstruct why an unusual permission remained. If there was an exception, the record should make its owner and end condition clear.
In an interview, this gives you a more substantial example than “I added users to groups.” You can explain the business change and how you prevented old access from becoming invisible baggage.
The lifecycle project in The Six-Figure IAM Career Playbook is a practical place to build that example. The $9 guide combines it with role selection and portfolio guidance so the work supports a specific career direction.
The transfer is complete when the access matches the new responsibility, including the old access that should no longer be there.