Lifecycle & Access Governance
Transfer Account
Move a user to a new role: they gain what it grants and lose the roles and privileges it doesn't include.
Completes when the approved transfer gives the user the new role and removes their other roles and the privileges it doesn't include.
https://mcp.avatier.com/mcp
Ask in Plain Language
Run Transfer Account from the AI Assistant You Already Use
Same policy, approvals and Justification as the web app, with identity verification first in Avabot and MCP. One completed transfer = one Secure Outcome; failed attempts are never billed.
You: Transfer Priya Shah to the Sales Manager role. Reason: promotion. Avatier: verify: passed · role: Sales Manager · current roles: removed on approval · request: submitted, may need approval
Why it matters
Access Creep Starts the Day Someone Changes Roles.
As employees move through the organization, access has to follow: adding what their new role requires and removing what no longer fits.
What a transfer needs
The new role's privileges granted, the roles and privileges it doesn't include removed, on the date you choose, with a justification on the record.
What goes wrong by hand
Moving someone by hand means adding the new role's access and finding every old role and privilege that should go, while keeping the ones both roles share. Miss one and it stays.
Why it matters now
Access that outlives the job it was granted for is privilege bloat, stale access and insider risk.
What per-seat pricing charges
Per-seat IAM charges for every licensed seat, whether anyone transfers this month or not. Pay Per Identity Action™ charges only for completed transfers.
The Action
How Transfer Account Runs
On the web, Transfer Account walks through these screens. In Avabot and MCP you verify, pick the role, give a reason and confirm a read-back of what the role grants and which current roles will be removed.
Verify in Avabot or MCP
Avabot and MCP only. Transfer Account starts with identity verification in the conversation, with the methods your policy already allows, such as Security Questions, Google Authenticator, PingID Push or Identity Challenge Card. By default it verifies again when the last check is more than 5 minutes old.
Identity Verification (Avabot and MCP)
Select the User
On "Select user you wish to Transfer", pick a connector and search by name. Only users who already hold access through a role can be transferred. Workflow admins are then asked "Would you like to use workflow?"
Set the Schedule
Choose Transfer Now, a date and time, or in a number of days, hours or minutes. Set Transfer Account Termination to Never or a date, and enter a Justification. An admin acting without workflow skips the schedule and justification.
Pick the New Role
Choose the destination role from a searchable, sortable list.
Check the Summary
Review User Info, Start Date, End Date and Role Info, with Show assigned Privileges, on the Transfer Account Final Result screen, and export it to Excel or PDF.
Submit
Choose Submit Request and confirm. The request is recorded in Request History with a Request ID and goes through the new role's approval workflow. A workflow admin who chooses not to use workflow is recorded as the approver, and the transfer runs at once.
Approval point
Available on Web, Mobile, Teams, Avabot chat and MCP.
Avabot chat and MCP require the current (.NET 10) Avatier server.
In Avabot chat and MCP, a transfer starts immediately, has no end date and always goes through workflow.
Secure Outcome
What Counts as Done
A Secure Outcome is a completed, verified, policy-compliant identity action. A transfer completes when the approved request runs: the user gets the new role, every other role assignment is removed, privileges the new role doesn't include are removed, and privileges both roles share are kept. One completed transfer = one Secure Outcome.
Evidence
- A Request ID in Request History (exportable)
- An activity-log entry
- Request emails
- The Transfer Account Final Result summary (Excel or PDF, on the web)
Guardrails
Your Assistant Asks. Avatier Decides.
Verified First
Avatier verifies the person before sensitive changes, with the methods your policy already allows.
Acts as the Signed-In User
OAuth sign-in to your own tenant. No shared service account, no API key to manage.
Never Makes Up Values
The connector only sends what the person actually said, and asks when something is missing.
Every Request Recorded
Requests land in Request History, ready to review and export.
Pay Per Identity Action™
Pay per Completed Transfer
Pay per completed transfer. Failed attempts are never billed.
| Compared | Manual or Per-Seat IAM | Transfer Account, Pay Per Identity Action™ |
|---|---|---|
| What you pay for | Every licensed seat, whether it acts or not | Completed transfers only |
| Failed attempts | No line between an attempt and a result | Attempts, failures and retries are never billed |
| The work | Access creep, privilege bloat and stale accounts | The new role is granted, other roles and the privileges it doesn't include are removed, and shared privileges are kept |
| Evidence | Silent failures and missing audit trails | A Request ID in Request History, an activity-log entry and request emails |
Pay Per Identity Action™ is in invitation-only preview. Pricing is shared with qualified organizations.
Works with the Systems Transfer Account Touches
Transfer Account reaches whatever systems the old and new roles' privileges are provisioned to, through their connectors, such as Active Directory or Entra ID groups, LDAP or application entitlements. Privileges that people fulfil by hand become manual grant or removal tasks.
- LDAP
- Microsoft
- Active Directory and Entra ID groups, through their connectors.
- Other Systems
- LDAP and application entitlements through their connectors, and manual grant or removal tasks for privileges people fulfil by hand.
Avatier MCP
New to Avatier MCP?
The Model Context Protocol is an open standard, stewarded by the Linux Foundation, that lets AI assistants call real systems through connectors instead of custom integrations.
Up and Running in Under a Minute
One URL works in every MCP client. Pick yours, copy, paste, sign in.
Microsoft Copilot Studio
Claude Code
OpenAI Codex
Cursor
Frequently Asked Questions
Why won't it let me transfer this user?
Transfer only works for someone who already holds access through a role. Otherwise it says "Can't Transfer a User Who Has No Existing Role-Assigned Privileges"; use Request Role instead. It is also refused while another transfer for the same user is in progress.
What happens to the user's current access?
The user gets the new role's privileges and loses the privileges the new role doesn't include. All other role assignments are removed, shared privileges are kept, and access granted outside roles stays.
Can a transfer be scheduled?
On the web, yes: when you send it through workflow, pick a date and time or a number of days, hours or minutes, plus an optional termination date. Through Avabot it starts immediately.
Does Avatier provide AI-driven compliance reporting?
Yes. Avatier turns continuous identity and access data into audit-ready reports on demand, using AI to assemble who has access to what, what changed, and who approved it, mapped to the controls auditors expect. Instead of a manual evidence scramble before each audit, you generate plain-language, exportable reports covering SOC 2 Type II and ISO 27001, plus the evidence needs associated with NIST, SOX, HIPAA, and GDPR.
What is AI-driven configuration?
Avatier's AI-driven config turns plain-language intent into working policy. Rather than hand-coding rules, connectors, and roles, administrators describe what they need and Avatier recommends and sets up provisioning rules, role mappings, and workflows, then validates them before they go live. It shortens deployment from months to days and keeps configuration consistent, auditable, and free of custom scripting.
What is Pay Per Identity Action™?
Pay Per Identity Action™ is Avatier's pricing mechanic. Customers pay only for completed, verified, policy-compliant identity actions, called Secure Outcomes.
Is it the same as pay-per-action advertising?
No. Pay per action (PPA) is performance-marketing vocabulary for paying when an ad converts. Pay Per Identity Action™ charges for completed identity work.
How do I get started?
Getting started is free, deployment services are included, and a 45-day money-back guarantee applies. Contact Avatier for pricing for your organization.
What is MCP?
The Model Context Protocol is an open standard, stewarded by the Linux Foundation, that lets AI assistants call real systems through connectors instead of custom integrations.
How is it billed?
Pay Per Identity Action™ is in invitation-only preview: each completed, verified action is one Secure Outcome, and attempts, failures and retries are never billed.
Transfer Account
You've Automated the System. Now Secure the Lifecycle.
Automation can solve most IT tasks, but identity lifecycle management remains a critical, manual risk.