Skip to content

Stop (de-)provisioning using tickets.

Let your HRIS dictate the identity lifecycle.

The Problem

IT usually responds to tickets regarding new hires, role changes, and departures, and then updates each system manually. It's slow and easy to get wrong. If someone leaves and HR forgets to write a ticket for IT, the open account poses a security risk.

A US state government network was breached through the account of a former employee — an account that was not disabled when they left.
CISA and MS-ISAC, advisory AA24-046A, 2024
IT Service Desk
Open requests
New request
My queueAll openUnassigned4 open
Provision accounts for new hire Priya Nair
ITSD-4821·Open·4d
JM
Update access for Hana Berg after dept change
ITSD-4795·Escalated·8d
RT
Offboard and revoke access for Lars Møller
ITSD-4760·Waiting·2d
JM
Add Marketing licenses for 3 transfers
ITSD-4737·In progress·5d
RT

Automated Joiner, Mover, and Leaver

Klef treats your HRIS as the source of truth. Your policies detail which accounts, access levels, and licenses each worker should have. Klef then keeps everything aligned.

As HR hires, fires, and promotes, Klef picks up on any change and propagates it downstream according to your policies. There's no need to involve IT.

AD

ADP

Onboarded
Accounts provisioned
Licenses granted
Mi

Microsoft Entra ID

Directory

Sales group
Mi

Microsoft 365

Productivity

E5 license
AW

AWS

Cloud

Expense seat
Or

Oracle Fusion

Finance ERP

No access

Reviewable by Design

Changes are detailed in a plan. That plan lists every change needed to bring the downstream systems in-line with your policies. This enables you to review changes before they are made.

Sync plan
Applied
41 added1,198 updated45 removed
Erin WalshAdded
MiMicrosoft Entra ID
mailerin.walsh@acme.co
departmentMarketing
GoGoogle Workspace
orgUnit/Marketing
Hana ColeUpdated
MiMicrosoft Entra ID
departmentSalesMarketing
MiMicrosoft 365
licenseE3E5
AWAWS
Nia BennettRemoved
MiMicrosoft Entra ID
MiMicrosoft 365