> ## Documentation Index
> Fetch the complete documentation index at: https://docs.lumos.com/llms.txt
> Use this file to discover all available pages before exploring further.

# Mover Workflows

As employees move between teams, get promoted, or change worker type, their access needs to be updated quickly. **Mover Workflows** ensure that access is granted and revoked based on each employee’s current role without waiting on IT tickets or manual reviews.

Each workflow provides full visibility and audit logging, helping your organization maintain compliance and least-privilege access at scale.

***

## What Are Mover Workflows?

Mover Workflows are automated processes that trigger whenever a user-defined attribute (eg. role, department, manager, worker type, etc.) changes.

Each workflow runs a sequence of steps. Today’s release includes:

* **Re-evaluate Access** – Compare policies before and after the role change (required first step).

* **Apply Access Changes** – Automatically runs workflows to grant or revoke access as needed based on the Re-evaluate Access step.

* **Wait (optional)** – Add a configurable delay before access is granted.

* **Send notification (optional)** - Send a customized notification to any user (eg. the new manager).

***

## Why Use Mover Workflows (Grants)?

* **Day 1 Productivity** – Employees get access to their new tools immediately after role changes.

* **Continuous Compliance** – Automatically remove access no longer valid after a transition.

* **Reduced IT Burden** – Eliminate manual provisioning and deprovisioning tickets.

* **Audit Visibility** – Each workflow run is logged with details on the attribute changes and access granted.

***

## Setting Up a Mover Workflow

1. **Go to**: *Employee Lifecycle > Movers*
2. **Click** the **Settings** button (top right).
3. **Enable Mover Workflow** under *General*.
4. **View triggers**: Auto-selects user attributes associated with access policies.
5. **Define workflow steps** (at minimum: Re-evaluate Access → Apply Access Changes).
6. **Save and test**: Monitor the first set of Mover Workflows.

***

## Viewing Mover Workflows

In *Employee Lifecycle > Movers*, you can track:

* **In Progress** – Workflows currently running.
* **Completed** – Past workflows, with step-by-step details of what ran.
* **Events** – Raw attribute changes detected.

Clicking into a workflow shows:

* Who was impacted.
* Which attributes changed.
* Which steps ran.
* What access was granted.

***

## Understanding Workflow Details

Every Mover Workflow shows a breakdown of how each entitlement was handled:

* **Re-evaluate Access -** Result from comparing user's access before and after the role change.

* **Apply Access Changes**

  * **Grant** – New access added because the employee’s updated attributes require it.
  * **Revoke** – Access that was valid before but is no longer required after the change.
  * **No Changes** – Access that remained valid before and after the change. Lumos leaves this access as-is and logs it for visibility.

***

## FAQs

**Q: Does this remove access too?**\
Yes - Lumos supports granting and removing access based on attribute changes.

**Q: How quickly do workflows run?**\
Lumos detects mover events during scheduled syncs. To avoid running multiple workflows for the same person in a short period of time, Lumos **batches all attribute changes for an identity within a 6-hour window**. This means:

* Any changes made during that window are grouped into a single workflow run.
* The workflow will execute within 6 hours of the first detected change.

**Q: Do I need to update my policies?**\
The **Re-evaluate Access** step references your Access Policies when deciding what access changes should occur. Lumos strongly recommends ensuring your Access Policies are up-to-date prior to enabling Mover Workflows.

Ensure the policy conditions are listening to the correct attributes, and also ensure the Apps and Entitlements that should be assigned are accurate.

**Q: How does Lumos determine what access to remove?**

Lumos automatically compares the user’s access before and after the attribute change, based on your Access Policies. Any apps or entitlements that no longer match the updated policies are revoked.

Access granted outside of policy (for example, through an AppStore request) is not automatically removed, ensuring no disruption to legitimate exceptions.

**Q: Can I add a wait step between grants and revocations?**

You can add a **Wait** step before access changes are applied. However, grant and revoke actions within the **Apply Access Changes** step always run in parallel, ensuring updates happen together and preventing delays caused by staggered provisioning.

***

## Need Help?

Reach out to [support@lumos.com](mailto:support@lumos.com) or your CSM to get started with Mover Workflows.