Employee Offboarding & Deprovisioning
Automatically cut access, recover assets, and close loops when an employee or contractor leaves. Cleanup that's boring when it works and catastrophic when it doesn't.
On this page
Visual Flow
Rendering diagram…
When to Use This Pattern
Use offboarding orchestration any time the cost of lingering access is non-trivial:
- Employees with access to production systems, customer data, or financial tools
- Contractors whose scope ends at a specific date
- Partners or vendors whose contracts lapse
- Interns whose stint is over
Even in a small company, this can't be manual — it gets forgotten and becomes an audit finding or a breach vector.
How It Works
HR marks someone as terminated with an effective date and time. The workflow fans out to every department with offboarding responsibilities:
- IT: disable login, revoke SSH keys, rotate shared secrets the person knew, forward email
- SaaS ops: revoke licenses from every tool (reclaim the seats while you're at it)
- Facilities: recover laptop, badge, keys, any remote-work equipment
- Finance: close expense card, process final payroll, handle equity/benefits transitions
- Manager: knowledge transfer handoff, retain necessary documentation
Each lane is tracked. The workflow completes only when every lane confirms done. Incomplete lanes escalate loudly — a laptop that never came back is a known asset, not a mystery.
Involuntary terminations need a different timing than voluntary. Access must be cut before the person is told, not after. Design two flows, not one.
Implementation Guide
Step 1: Inventory systems that grant access
Every SaaS, every internal system, every shared credential. If you can't list it, you can't offboard from it. This alone typically uncovers long-tail tools no one was tracking.
Step 2: Map employee → access
Per role, per employee, what do they have? SCIM, SSO, IAM — whatever your setup, the source of truth must be queryable.
Step 3: Automate what you can
Anything behind SCIM or SAML deprovisions automatically. Where manual steps remain, make them tasks in a tracking system with owners and deadlines. "Send email to vendor X" is fine — just track it.
Step 4: Time it correctly
Voluntary: deprovision at end of last working day. Involuntary: deprovision before the conversation — use HR's advance notice and automate the cut at a scheduled time.
Step 5: Verify and report
At the end, generate a report: what was revoked, what was pending, what timed out. Close the loop explicitly. If anything is still pending 48 hours later, escalate to the manager's manager.
Tips & Best Practices
- Keep a shared secrets inventory. If they knew the VPN key, rotate it.
- Communicate with external parties. Customers and partners who had a direct relationship with the person should be proactively informed and re-assigned.
- Archive their work, don't delete it. Documents, code, tickets — leave the record for continuity.
- Preserve mailbox and records per retention policy. Legal holds trump deletion.
- Debrief quarterly. Missed steps are lessons. Fix the process, not the person.
Related patterns
Employee Onboarding Orchestration
Coordinate the multi-department new-hire onboarding process — from IT provisioning and HR paperwork to manager introductions and training enrollment. Ensure nothing falls through the cracks.
Vendor Qualification Pipeline
Evaluate, verify, and approve new vendors before they can do business with your organisation. Collect documentation, perform due diligence, assess risk, and make go/no-go decisions.
Customer Self-Service Registration
Allow customers to register, provide required documentation, and get verified through an automated workflow. Reduce manual intake work while maintaining KYC and compliance requirements.