Skip to content

06-leaver-workflow.md

Latest commit

 

History

History
104 lines (74 loc) · 3.54 KB

06-leaver-workflow.md

File metadata and controls

104 lines (74 loc) · 3.54 KB
Raw

Leaver Workflow

Automated Deprovisioning on Offboarding

Objective

When an employee leaves the organization, automatically and completely remove all access in a timely, auditable manner — closing the security gap that orphaned accounts and lingering access create.

The Problem This Solves

Offboarding is where many organizations are most exposed. When access removal is manual, accounts are often left active after departure — orphaned accounts with standing access that no one is monitoring. These are a prime target for compromise and a serious insider-risk and compliance liability.

The Leaver workflow ensures departure triggers complete, prompt, logged deprovisioning.

Trigger

An employee record is marked as terminated, resigned, or end-dated in the HR system. For planned departures, the workflow can be scheduled to execute at a precise effective time.

Workflow Steps

1. HR marks employee as terminated/end-dated
              │
              ▼
2. Identity Engine detects departure
              │
              ▼
3. Determine timing (immediate vs scheduled)
              │
              ▼
4. Disable account (block sign-in immediately)
              │
              ▼
5. Revoke active sessions & tokens
              │
              ▼
6. Remove all group memberships & app access
              │
              ▼
7. Handle data (mailbox, files — transfer/retain)
              │
              ▼
8. Reclaim licenses
              │
              ▼
9. Log all actions to audit layer
              │
              ▼
10. Notify manager & IT — offboarding complete

Detailed Step Breakdown

Step 1–2: Detection

The Identity Engine monitors HR for termination or end-date events. Detection triggers the leaver workflow.

Step 3: Timing

  • Immediate terminations execute at once.
  • Planned departures can be scheduled to execute exactly at end-of-employment, avoiding both premature lockout and lingering access.

Step 4–5: Immediate Containment

The first and most important action is disabling sign-in and revoking all active sessions and tokens. This immediately closes the access window, even before full cleanup completes. A disabled account with revoked sessions cannot be used.

Step 6: Access Removal

All group memberships and application entitlements are removed, fully deprovisioning the identity.

Step 7: Data Handling

Mailbox and file access are handled according to policy — typically transferred to the manager or placed on retention/legal hold as required. This preserves business continuity and compliance obligations without leaving the account active.

Step 8: License Reclamation

Software and service licenses are reclaimed and returned to the available pool, controlling cost.

Step 9: Audit Logging

Every deprovisioning action is logged with timestamp and the triggering HR event, producing a complete offboarding record for audit and compliance.

Step 10: Notification

The manager and IT are notified that offboarding is complete, with a summary of actions taken.

Business Value

Before After
Orphaned accounts linger Access removed promptly and completely
Manual, error-prone offboarding Automated, consistent deprovisioning
Standing risk from old accounts Immediate session revocation
Unclear offboarding record Full audit trail per departure

Reference Implementation

See scripts/leaver-deprovisioning.ps1 for a PowerShell reference implementation.