Provision and revoke app access for new hires before onboarding

Your identity requests arrive without consistent role membership, causing orphaned permissions and extra helpdesk tickets. IT identity admins get predictable role assignments and removals so access is correct before the new hire's first day.