What this automation does
Offboarding is mostly a race to remove access without losing anything the business needs. The workflow runs the same steps in the same order every time.
- Trigger. HR enters the termination in the HRIS with the last day and type (voluntary or involuntary). Involuntary cases can also be started from a restricted HR form with an exact cutoff time.
- Schedule the cutoff. The workflow sets the access cutoff for the end of the last day, or for the meeting time in an involuntary case.
- Suspend identity. At cutoff, it suspends the account in Google Workspace, Microsoft Entra ID or your identity provider, signs out active sessions and resets the password.
- Revoke app access. It removes the person from Slack, GitHub, the CRM, the password manager and every app on their access record, and removes OAuth grants and API tokens they created where the app allows it.
- Preserve data. Drive files transfer to the manager, the mailbox converts to a shared mailbox or forwards to the manager, and recurring meetings they owned are reassigned.
- Equipment. IT gets a ticket and remote employees get a prepaid return kit with a tracking number logged against the asset.
- Payroll and benefits. Payroll and the benefits administrator are notified with the dates they need.
- Handoff draft. A model drafts a handoff document listing open work, owned documents and key contacts. The manager reviews it during the notice period.
- Audit log. Each step records what was removed, when and by which process.
When it is worth building
Offboarding automation is a security project as much as an HR one. It is worth building once you have more than a dozen or so SaaS apps, any customer or audit requirement to show timely access removal, or a history of finding former employees still in a shared tool months later.
At a very small company with a handful of apps, a checklist run by one person is fine. If you already use a platform that links HR records to app access for the apps you care about, start there and only automate the gaps, such as apps it does not support or the handoff document.
Architecture
| Layer | What we use | Why |
|---|---|---|
| Trigger | BambooHR, Rippling or Gusto termination event, or a restricted HR form | Starts from HR’s decision, with the dates HR entered |
| Access inventory | The onboarding access record plus an app list from your identity provider | You cannot revoke what you do not know someone has |
| Orchestration | n8n, self-hosted for this use case | Runs with admin credentials, so it should live on infrastructure you control |
| Identity | Google Workspace Admin SDK, or Microsoft Graph plus Exchange Online PowerShell | Suspend, sign out and transfer ownership through official admin tooling; converting a Microsoft 365 mailbox to a shared mailbox is done in Exchange Online PowerShell, not Graph |
| App revocation | SCIM endpoints where the app offers them, otherwise each app’s REST API | Deprovisioning APIs are often gated by plan tier; Slack’s SCIM API, for example, is only available on its higher-tier plans |
| IT tickets | Jira Service Management or your helpdesk | Equipment and manual steps are tracked like any other request |
| Handoff draft | Claude through the API, reading only work metadata | Speeds up the manager’s handoff without reading private messages |
| Evidence | Append-only log with timestamps | Gives auditors and security a clean record per departure |
How to build it
- Build the access inventory. List every app, who administers it, whether it is behind single sign-on, and how to remove a user. Apps outside single sign-on need the most attention.
- Define the two paths. Write separate runbooks for voluntary and involuntary departures, including who is notified and when.
- Automate identity first. Suspending the identity provider account cuts off every single-sign-on app at once, so it delivers most of the value early.
- Add app-by-app revocation. Work through apps with local accounts, shared credentials and API tokens. Rotate shared passwords the person knew.
- Handle data preservation. Script file transfer, mailbox conversion and meeting reassignment, and confirm each completed before suspension becomes deletion.
- Add the handoff draft. Pull open tickets, owned documents and recurring meetings, and have a model organize them into a draft for the manager.
- Test on a dummy user. Create a test employee with access to everything and run both paths end to end before the first real departure.
The downloadable starter template below covers the HRIS trigger, scheduled cutoff, Google Workspace suspension with Drive transfer, an IT ticket listing the remaining apps, and the audit log.
For the provisioning side of the same identity plumbing, see our guide to automating user provisioning and deprovisioning.
What breaks in production
- Apps outside single sign-on. Legacy tools and team-bought SaaS keep their own logins. Suspending the identity account does nothing for them.
- Tokens that outlive the account. Personal access tokens, OAuth apps and API keys created by the departing person can keep working. Revoke them where the app supports it and rotate integration credentials they owned.
- Integrations owned by the user. A Zapier account or a scheduled report owned by the departing person stops working, or keeps sending data to their personal email. Inventory ownership before the last day.
- Early notifications. A bot posts “Please say goodbye to Jamie” to a channel before HR has spoken to Jamie. Silence all announcements on the involuntary path.
- Legal holds. Data under a litigation hold must not be deleted on the normal schedule. Check a hold list before any deletion step.
- Rehires and conversions. An employee converts to a contractor. Treat it as an offboarding plus a new onboarding with narrower access, not a quiet change of title.
Timeline and cost
Most teams are live in two to four weeks, depending on how many apps need individual revocation logic. Lumeor builds this in the range of $6,000 to $12,000, with the low end covering the identity provider, data transfer and core apps, and the high end covering a longer app list, both termination paths and the handoff draft. If you are also automating new-hire setup, building both together around one access record, as described in the onboarding guide, saves rework.
How to measure success
- Minutes from cutoff time to identity account suspended
- Share of apps revoked automatically versus by a manual ticket
- Accounts belonging to former employees found in quarterly access reviews, which should reach zero
- Equipment recovered within 30 days of departure
- Completeness of the audit log for each departure
- Manager rating of the handoff draft, and how much they had to add