IT & Security package
A nightly job reads joiners, movers and leavers from the HR system and creates, updates or disables directory accounts with role-based groups, logging every action.
About this package
Joiner, mover, leaver sync keeps your directory in step with the HR system without tickets. Every night at 02:00 it asks the HR system for the workforce changes effective since the previous day.
Each change is processed in turn. The Role mappings table (department and job family) gives the birthright groups and licence for the role. Joiners get a new directory account with those groups, movers have their department, manager, groups and licence updated, and leavers are disabled with their sessions revoked and groups removed. Every action, including failures, is written to the JML sync log table with the HTTP status, so you can filter for anything that needs attention.
A summary of joiners, movers and leavers is written to the run log at the end. Adapt the role mappings to your groups and licences, and the HR and directory API paths to your platforms. Runs can also be started by hand with a since date to replay a period.
Daily at 02:00 (Pacific/Auckland). You can also start it any time from the Run dialog, the API or the CLI.
Runs on a schedule (daily, weekly, monthly) in your time zone.
The flow
Nightly at 02:00
The schedule trigger starts the run and works out the since date (yesterday unless one is passed).
Read HR changes
List HR changes returns the joiners, movers and leavers effective since that date.
Map the role
For each change, the Role mappings row for the department and job family gives the groups and licence.
Apply to the directory
Joiners are created, movers updated with their new groups and licence, and leavers disabled with sessions and groups revoked.
Log every action
Each change is written to the JML sync log table with the action, directory user, groups and HTTP status; a summary goes to the run log.
Forms
The inputs a caller passes when it starts a run, and the forms people complete when the process needs a decision.
Start inputs
Passed by the calling system
From your code
Every workflow can be started over REST, MCP or the CLI, whatever its trigger, with the sample input below. Runs start straight away on the published version; replace <workflow id> with the id the install created.
REST
curl -X POST "$USERTASKS_URL/api/v1/workflows/start" \
-H "Authorization: Bearer $USERTASKS_API_KEY" \
-H "Content-Type: application/json" \
-d '{"workflow_id":"<workflow id>","variables":{"since":"2026-10-25"}}'CLI
usertasks workflows inputs <workflow id> # the start form: keys, types, required
usertasks workflows run <workflow id> --input since=2026-10-25 --waitWhat's included
| Type | Name | Details |
|---|---|---|
| Data table | JML sync log | One row per HR change processed by the nightly sync: what was done in the directory and whether it succeeded. Filter by status to find failures. |
| Data table | Role mappings | Birthright access by department and job family: the directory groups (comma-separated) and licence a person in that role gets. The key is "Department|Job family". Unmapped roles get all-staff and the standard licence. |
| Integration | Directory | |
| Integration | HR system | |
| API reference | Create user | POST /users — Create a directory account for a joiner with the groups and licence from the Role mappings table. |
| API reference | Disable user | POST /users/{{user_id}}/disable — Disable a leaver: block sign-in, revoke sessions and remove group memberships. |
| API reference | List HR changes | GET /hr/changes — Workforce changes (joiners, movers and leavers) effective since a date. |
| API reference | Update user | PATCH /users/{{user_id}} — Move a user: new department, title, manager, groups and licence. Groups not in the list are removed. |
| Workflow | Joiner mover leaver sync | 22 steps — Every night, reads the HR changes since the last run and applies each one to the directory: creates joiners with their birthright groups, updates movers, disables leavers, and logs every action. |
JML sync log · schema only
Synced atHR changeEmployeeNameChange typeDirectory actionDirectory userGroupsLicenceHTTP statusStatus
Role mappings · 7 sample rows
Key (Department|Job family)DepartmentJob familyGroupsLicence
Requirements
Credentials never travel in a package. The install wizard asks for what your environment must provide, or installs it incomplete until you finish setup.
Integration “Directory”Required
Integration “HR system”Required
Install
Works on UserTasks cloud and on any self-hosted instance. Installing creates the assets above; nothing runs until you complete setup and start it.
curl -fLO https://usertasks.com/gallery/joiner-mover-leaver-sync-1.0.0.utpkg
usertasks packages inspect joiner-mover-leaver-sync-1.0.0.utpkg # offline: checksum, hashes, signature
usertasks packages install joiner-mover-leaver-sync-1.0.0.utpkg --dry-run
usertasks packages install joiner-mover-leaver-sync-1.0.0.utpkg # prompts for each requirement
usertasks packages install joiner-mover-leaver-sync-1.0.0.utpkg --keep-incomplete --yes # in CI; finish with:
usertasks packages complete joiner-mover-leaver-sync -f values.yamlVerify the download
shasum -a 256 joiner-mover-leaver-sync-1.0.0.utpkg should print the file SHA-256. How gallery packages are signed.
Versions
Installing a newer version upgrades in place: local credentials and requirement values are kept, and changes you made are flagged first. How packages work
More packages
IT & Security
People request application access from a form; risk-based approvals route it, the grant is provisioned automatically and time-boxed access is revoked on expiry.
Needs:REST APIAssigneesEmail
IT & Security
An RFC form scores change risk, routes to pre-approval, CAB or emergency CAB, then tracks implementation and the post-implementation review in your ITSM.
Needs:REST APIAssigneesEmail
IT & Security
Monitoring alerts open prioritised ITSM incidents automatically; repeat alerts are deduplicated and P1/P2 incidents page the on-call engineer with escalation.
Needs:REST APIAssigneesInbound webhook