Lifecycle & Access Governance
Transfer Account
Department and role transfers apply new role-based access control (RBAC) entitlements and remove outdated access.
Completes when the user holds the new role from the execution date you set.
https://mcp.avatier.com/mcp
Ask in Plain Language
Run Transfer Account from the AI Assistant You Already Use
Same policy, approvals and Justification as the console. One completed transfer = one Secure Outcome; failed attempts are never billed.
You: Transfer Priya Shah to the Sales Manager role, effective the 1st. Avatier: policy: applied · role: Sales Manager · execution date: the 1st · request: recorded
Why it matters
Access Creep Starts the Day Someone Changes Roles.
As employees move through the organization, access has to follow: adding what their new role requires and removing what no longer fits.
What a transfer needs
The new role's entitlements applied, outdated access removed, on the date you choose, with a justification on the record.
What goes wrong by hand
Lack of Automated Lifecycle Governance: no automated process exists to reconcile user status with access rights.
Why it matters now
Access that outlives the job it was granted for is privilege bloat, stale access and insider risk.
What per-seat pricing charges
Per-seat IAM charges for every licensed seat, whether anyone transfers this month or not. Pay Per Identity Action™ charges only for completed transfers.
The Action
How Transfer Account Runs
Transfer Account follows the same pattern as every lifecycle action: select the user, fill in the form, check the summary, submit.
Select the User
Pick the user who is changing roles.
Pick the New Role
Choose the role they are moving to in the role picker.
Set the Timing
Choose an Execution Date, now or scheduled, and a Transfer Account Termination: never, or on a date.
Check the Summary
Confirm the Domain, UserId, role, dates and justification on the Transfer - Summary screen.
Submit
Submit the request. It is recorded with a Request ID.
Available on Web, Avabot chat and MCP.
Secure Outcome
What Counts as Done
A Secure Outcome is a completed, verified, policy-compliant identity action. A transfer completes when the user holds the new role from the execution date you set. One completed transfer = one Secure Outcome.
Evidence
- A Request ID
- Request History with Export
- "Cancelled by Transfer" on superseded requests
Guardrails
Your Assistant Asks. Avatier Decides.
Verified First
Avatier verifies the person before sensitive changes, with the methods your policy already allows.
Same Policy as the Console
Approvals, justification and role rules apply exactly as they do on the web.
Acts as the Signed-In User
OAuth sign-in to your own tenant. No shared service account, no API key to manage.
Never Makes Up Values
The connector only sends what the person actually said, and asks when something is missing.
Every Request Recorded
Requests land in Request History, ready to review and export.
Pay Per Identity Action™
Pay per Completed Transfer
Pay per completed transfer. Failed attempts are never billed.
| Compared | Manual or Per-Seat IAM | Transfer Account, Pay Per Identity Action™ |
|---|---|---|
| What you pay for | Every licensed seat, whether it acts or not | Completed transfers only |
| Failed attempts | No line between an attempt and a result | Attempts, failures and retries are never billed |
| Old access | Access creep, privilege bloat and stale accounts | Continuous Governance™ removes what no longer fits the new role |
| Evidence | Silent failures and missing audit trails | A Request ID on every request, and Request History with Export |
Pay Per Identity Action™ is in invitation-only preview. Pricing is shared with qualified organizations.
Works with the Systems Transfer Account Touches
Avatier connects to 70+ of the world's most widely used HR and payroll systems through a single unified integration, including Workday, SAP SuccessFactors, Oracle Cloud HCM, ADP, UKG, and Dayforce in the enterprise, and Paychex, Paylocity, Paycom, Rippling, TriNet, and Deel across mid-market and global payroll.
- UKG
- Dayforce
- Microsoft 365
- Microsoft
- Active Directory, Entra ID, and Microsoft 365 licensing.
- Cloud Apps and Legacy Systems
- Accounts created and updated across cloud apps and legacy systems.
Avatier MCP
New to Avatier MCP?
The Model Context Protocol is an open standard, stewarded by the Linux Foundation, that lets AI assistants call real systems through connectors instead of custom integrations.
Up and Running in Under a Minute
One URL works in every MCP client. Pick yours, copy, paste, sign in.
Claude
Claude Code
GitHub Copilot
Cursor
Gemini CLI
Frequently Asked Questions
What happens when someone transfers, changes their name, or is rehired?
Avatier automatically updates their profile, applies the correct RBAC entitlements, removes outdated permissions, updates groups, updates email aliases, pushes HR properties downstream, and adjusts Microsoft 365 licensing. Rehires are reactivated with the right role-based access instantly, with no manual intervention or tickets needed.
What is Continuous Governance™?
Avatier's patent-pending Continuous Governance™ performs automatic role reconciliation across the user lifecycle, continuously removing access that no longer fits and restoring access aligned with each user's current role, enforcing least privilege by default and eliminating access creep.
How does Avatier prevent access creep?
Continuous Governance™ continuously performs role reconciliation, automatically removing access that no longer aligns with a user's job function. This prevents privilege bloat, stale accounts, and insider risk.
Does Avatier provide AI-driven compliance reporting?
Yes. Avatier turns continuous identity and access data into audit-ready reports on demand, using AI to assemble who has access to what, what changed, and who approved it, mapped to the controls auditors expect. Instead of a manual evidence scramble before each audit, you generate plain-language, exportable reports covering SOC 2 Type II and ISO 27001, plus the evidence needs associated with NIST, SOX, HIPAA, and GDPR.
What is AI-driven configuration?
Avatier's AI-driven config turns plain-language intent into working policy. Rather than hand-coding rules, connectors, and roles, administrators describe what they need and Avatier recommends and sets up provisioning rules, role mappings, and workflows, then validates them before they go live. It shortens deployment from months to days and keeps configuration consistent, auditable, and free of custom scripting.
What is Pay Per Identity Action™?
Pay Per Identity Action™ is Avatier's pricing mechanic. Customers pay only for completed, verified, policy-compliant identity actions, called Secure Outcomes.
Is it the same as pay-per-action advertising?
No. Pay per action (PPA) is performance-marketing vocabulary for paying when an ad converts. Pay Per Identity Action™ charges for completed identity work.
How do I get started?
Getting started is free, deployment services are included, and a 45-day money-back guarantee applies. Contact Avatier for pricing for your organization.
What is MCP?
The Model Context Protocol is an open standard, stewarded by the Linux Foundation, that lets AI assistants call real systems through connectors instead of custom integrations.
How is it billed?
Pay Per Identity Action™ is in invitation-only preview: each completed, verified action is one Secure Outcome, and attempts, failures and retries are never billed.
Transfer Account
You've Automated the System. Now Secure the Lifecycle.
Automation can solve most IT tasks, but identity lifecycle management remains a critical, manual risk.