What this automation does
When HR marks someone as hired, changing roles or leaving, the right accounts, groups and licenses follow automatically, and every change is logged.
- HR event. A new hire, role change or termination is recorded in the HR system, such as BambooHR, Rippling or Gusto. The workflow picks it up by webhook or by polling for changes.
- Resolve the access bundle. Department, title, location and employment type map to a defined bundle: identity groups, licenses, app roles and shared resources.
- Joiner. The identity account is created before the start date, groups and licenses are assigned, SCIM-connected apps provision themselves from group membership, and API-only apps get accounts through workflow steps. The manager gets a summary.
- Mover. Access for the new role is added and access tied only to the old role is removed after a short overlap, so people do not accumulate permissions over the years.
- Leaver. Sign-in is disabled and active sessions revoked first. Then group memberships are removed, licenses reclaimed, mailbox and files handed to the manager, and app accounts deactivated.
- Reconcile. A monthly job lists every account in every connected app and compares it to active HR records. Orphans, contractors past their end date and unexpected admins are reported.
When it is worth building
It pays off once you have more than a couple of hires or departures a month and more than ten apps. That is when manual checklists start missing steps, and the missed steps are usually on the way out: a former employee still in the CRM, a shared drive still accessible, a paid license nobody reclaimed. If you are pursuing SOC 2 or similar, auditors will ask for evidence of timely deprovisioning, and a logged workflow makes that easy.
Start with what you already pay for. If your identity provider supports HR-driven provisioning from your HR system and your key apps support SCIM on your plan, configure that first. Build workflows for the remainder. The HR-side steps, paperwork and welcome emails, belong in employee onboarding and offboarding automation, which this connects to.
Architecture
| Layer | What we use | Why |
|---|---|---|
| Source of truth | HR system such as BambooHR or Rippling; Gusto, ADP and Workday through their partner or customer-approved access | Employment status should come from HR, not from IT tickets |
| Identity | Microsoft Entra ID via Microsoft Graph, Google Workspace Admin SDK, or Okta | One place to disable sign-in for everything behind SSO |
| App provisioning | SCIM from the identity provider where supported | Standard, vendor-maintained and reacts to group changes |
| Gap workflows | n8n with built-in Slack, GitHub and Salesforce nodes, plus HTTP Request for other APIs | Covers apps without SCIM and steps like file ownership transfer |
| Access rules | A versioned table mapping department, title and employment type to bundles | Reviewable by IT and HR, changed without editing workflows |
| Approvals | Manager or app-owner approval in Slack or Teams for anything outside the bundle | Exceptions are allowed but always recorded |
| Audit | A log of every grant and removal with the triggering HR event | Evidence for audits and investigations |
How to build it
- Inventory apps and access methods. For each app, record whether it is behind SSO, supports SCIM on your plan, has a usable API, or is manual-only. This decides most of the build.
- Define access bundles. Start broad: a company-wide baseline, then per-department bundles. Avoid per-person exceptions in the rules; route those through approvals.
- Clean identity data first. Match HR records to identity accounts by employee ID, not by name or email alone. Fix duplicates, stale accounts and missing managers before turning automation on.
- Build the leaver flow first. It carries the most risk. Disable sign-in, revoke sessions and remove privileged roles as the first steps, then the slower cleanup. Add the HR “terminate now” trigger.
- Build the joiner flow. Create accounts a few days before start, with licenses timed to avoid paying for unused seats, and send the manager a readiness summary.
- Build the mover flow. Add new access immediately and remove old access after a defined overlap, with the manager confirming anything that should be kept.
- Add reconciliation. Pull user lists from each connected app monthly, compare against HR, and report orphans and unexpected admins to IT.
What breaks in production
- Rehires and name changes. A rehire matched by email reactivates an old account with old permissions. Match on employee ID and reset access to the bundle on rehire.
- Contractors outside the HR system. They never trigger a leaver event and keep access for months. Give contractors an end date in a tracked system and treat a missing end date as an error.
- Effective-date timing. A termination dated today in Pacific time runs at midnight Eastern, or a day late. Store and evaluate dates in the employee’s time zone.
- Disabled but not revoked. Disabling the account does not always end existing sessions or app-specific tokens. Revoke sessions explicitly, and remove personal access tokens in tools like GitHub.
- Data loss on deletion. Deleting an account too early deletes the mailbox and files the manager needs. Disable first, transfer ownership, and delete only after the retention window.
- API restrictions in HR platforms. ADP, Workday and some others require partner programs or customer-specific approval for API access, which can add weeks. Confirm access before committing to a date.
Timeline and cost
A joiner, mover and leaver program across one HR system, one identity provider and 8–15 apps typically takes four to eight weeks, longer if HR API access needs vendor approval. Lumeor builds this in the range of $15,000 to $35,000, depending on the number of apps without SCIM, data cleanup needed and approval complexity. A single leaver workflow on its own costs less and is a reasonable first step. See what an n8n automation program costs for how multi-workflow projects are priced.
How to measure success
- Time from termination to sign-in disabled, and to all app access removed
- Share of new hires with all baseline access working on their first morning
- Orphaned or unexpected accounts found by monthly reconciliation
- Manual provisioning tickets per month
- Paid licenses reclaimed per quarter