What Are Mover Workflows?
Mover Workflows are automated processes that trigger whenever a user-defined attribute (eg. role, department, manager, worker type, etc.) changes. Each workflow runs a sequence of steps. Today’s release includes:- Re-evaluate Access – Compare policies before and after the role change (required first step).
- Apply Access Changes – Automatically runs workflows to grant or revoke access as needed based on the Re-evaluate Access step.
- Wait (optional) – Add a configurable delay before access is granted.
- Send notification (optional) - Send a customized notification to any user (eg. the new manager).
Why Use Mover Workflows (Grants)?
- Day 1 Productivity – Employees get access to their new tools immediately after role changes.
- Continuous Compliance – Automatically remove access no longer valid after a transition.
- Reduced IT Burden – Eliminate manual provisioning and deprovisioning tickets.
- Audit Visibility – Each workflow run is logged with details on the attribute changes and access granted.
Setting Up a Mover Workflow
- Go to: Employee Lifecycle > Movers
- Click the Settings button (top right).
- Enable Mover Workflow under General.
- View triggers: Auto-selects user attributes associated with access policies.
- Define workflow steps (at minimum: Re-evaluate Access → Apply Access Changes).
- Save and test: Monitor the first set of Mover Workflows.
Viewing Mover Workflows
In Employee Lifecycle > Movers, you can track:- In Progress – Workflows currently running.
- Completed – Past workflows, with step-by-step details of what ran.
- Events – Raw attribute changes detected.
- Who was impacted.
- Which attributes changed.
- Which steps ran.
- What access was granted.
Understanding Workflow Details
Every Mover Workflow shows a breakdown of how each entitlement was handled:- Re-evaluate Access - Result from comparing user’s access before and after the role change.
-
Apply Access Changes
- Grant – New access added because the employee’s updated attributes require it.
- Revoke – Access that was valid before but is no longer required after the change.
- No Changes – Access that remained valid before and after the change. Lumos leaves this access as-is and logs it for visibility.
FAQs
Q: Does this remove access too?Yes - Lumos supports granting and removing access based on attribute changes. Q: How quickly do workflows run?
Lumos detects mover events during scheduled syncs. To avoid running multiple workflows for the same person in a short period of time, Lumos batches all attribute changes for an identity within a 6-hour window. This means:
- Any changes made during that window are grouped into a single workflow run.
- The workflow will execute within 6 hours of the first detected change.
The Re-evaluate Access step references your Access Policies when deciding what access changes should occur. Lumos strongly recommends ensuring your Access Policies are up-to-date prior to enabling Mover Workflows. Ensure the policy conditions are listening to the correct attributes, and also ensure the Apps and Entitlements that should be assigned are accurate. Q: How does Lumos determine what access to remove? Lumos automatically compares the user’s access before and after the attribute change, based on your Access Policies. Any apps or entitlements that no longer match the updated policies are revoked. Access granted outside of policy (for example, through an AppStore request) is not automatically removed, ensuring no disruption to legitimate exceptions. Q: Can I add a wait step between grants and revocations? You can add a Wait step before access changes are applied. However, grant and revoke actions within the Apply Access Changes step always run in parallel, ensuring updates happen together and preventing delays caused by staggered provisioning.