HR playbook · AI Employee: Harry

Employee Offboarding

Full offboarding within SLA; zero standing access after last day

Install this playbookBack to marketplace
The problem

Offboarding is onboarding in reverse — but the stakes are higher. A missed SSO revoke, a laptop that never came back, a Slack account still messaging customers a week after termination — each is a security incident, a compliance finding, or an embarrassing story. And unlike onboarding, you often don't get a second chance to fix it.

At a glance
Trigger
HRIS event (termination)
Approvals
HR + IT review before wipe
What it does
Writes to your systems
Systems
Workday · Okta · Google Workspace · M365 · Slack · Jamf · Payroll
How it feels in production

An hour-by-hour walkthrough.

Termination event fires from Workday at 4:47pm on Priya's last day. Harry reads it: name, effective date, termination type (voluntary), whether to preserve email forwarding, who takes over the files. 4:48pm. Harry moves in fast. SSO account suspended in Okta (all active sessions killed). Slack account deactivated. Google Workspace and Microsoft 365 licences released. Jamf remote-lock issued on the laptop with a 24-hour countdown to wipe (unless recovered). GitHub outside-collaborator access revoked. Salesforce and every non-SSO SaaS account provisioned during her tenure gets deprovisioned via the SaaS-management integration. 4:49pm. Email forwarding rule set (per policy) to route inbound mail to her manager for 30 days. Google Drive files transferred to her manager. Slack DMs and channels she was in get an audit trail preserved. 4:50pm. Final-payroll and benefits pack sent to her personal email. Manager gets a status card: 12 accounts revoked, 2 still pending manual review (a legacy SaaS that requires per-user contact), device lock issued. Everything logged to the immutable audit trail for security review. 24 hours later. Laptop hasn't returned. Wipe fires automatically. RMA ticket opens for tracking recovery. Manager notified.
How it works

Step by step.

  1. 01

    Read termination event

    HRIS fires the termination webhook. Harry parses: name, effective date, termination type (voluntary/involuntary/RIF), email-forwarding policy, file-transfer target, any legal-hold flag.

    HRIS
  2. 02

    Revoke SSO and kill active sessions

    Suspend the Okta / Microsoft Entra ID account, force logout on every active session, invalidate refresh tokens. Zero-standing-access target within 60 seconds of the termination event.

    Okta · Microsoft Entra ID
  3. 03

    Deprovision every named SaaS

    Iterate through the identity's SaaS grants (from Context Graph): Slack, Google Workspace, Microsoft 365, Salesforce, GitHub, Notion, Confluence, and the long tail. Each deprovision writes to audit; failures surface for manual follow-up.

    Slack · Google · M365 · Salesforce · GitHub · SaaS discovery
  4. 04

    Reclaim licences

    Return licences to your SaaS licence pool. High-value licences (Adobe, Figma, LinkedIn Sales Navigator) surface in the reclamation report and go to the next waiting-list requester.

    Licence management
  5. 05

    Wipe or lock device

    Issue MDM remote-lock immediately. If device is not returned within the policy window (default 24h), auto-wipe fires. Non-returned devices open an RMA ticket for tracking.

    Jamf · Intune · Kandji
  6. 06

    Transfer files and email

    Per policy: transfer Google Drive / OneDrive ownership to manager; set email forwarding rule (typically 30 days); preserve Slack DM audit trail. Legal hold overrides — files preserved and not transferred while hold is active.

    Google Drive · OneDrive · Slack · Email
  7. 07

    Send final-payroll + benefits pack

    Auto-email to the employee's personal address: final paycheck details, benefits continuation (COBRA / regional equivalent), 401(k) options, unused-PTO payout summary. HR gets the same summary for records.

    Payroll · Benefits · Email
  8. 08

    Confirm zero-access report to security

    Aggregate all revocation events into a zero-access report. Security team receives within 1 hour of termination. Any failed deprovision is red-flagged for immediate manual resolution.

    Slack · Audit log
Systems and wiring

What you connect to make this run.

Workday · BambooHR · HiBob · Rippling · ADP

trigger

Termination webhook enabled on the HRIS. Signed payload verified; Harry enqueues the offboarding playbook.

Okta · Microsoft Entra ID

write

Service account with user-suspend + session-invalidate scopes. Revoke happens first — every downstream deprovision runs after SSO is off.

Slack · Google Workspace · Microsoft 365 · Salesforce · GitHub

write

Per-provider admin credentials in Models Studio. Idempotent by external user ID; a retry doesn't cause a double-revoke.

Jamf · Intune · Kandji

write

MDM API credential with remote-lock + remote-wipe scopes. Wipe is timer-gated to allow physical return.

Context Graph

read+write

Read the identity's full grant history (which SaaS, which groups, which devices) before deprovisioning — nothing missed. Write revoke events to audit.

What changes

Before and after, honestly.

Time to zero standing access
Before
24-72 hours across manual IT tickets
After
Under 60 seconds after termination event
Missed deprovisions per offboarding
Before
1-3 (non-SSO SaaS routinely forgotten)
After
0 for SSO-connected; residual for legacy SaaS surfaces in the audit report
Device recovery rate
Before
60-80% (silent gaps become quarterly write-offs)
After
95%+ (auto-wipe timer + RMA ticket creates urgency)
Security-team time per offboarding
Before
~30 min manual review + follow-up
After
~2 min reading the zero-access report
Related

Playbooks that pair with this one.

HR

New Hire Onboarding

The mirror-image playbook; both share the same identity + provisioning wiring.

Security

Employee Offboarding

The security-owned view of the same underlying revocation flow.

IT

Contractor Access Expiration

Time-boxed variant for contractors on end-date.

HR

Manager Change Cascade

Prevents accidental offboarding when the trigger is a manager change, not a termination.

Frequently asked

Answers about this playbook.

What if the employee is on legal hold when they're offboarded?

Legal hold overrides the default. Files aren't transferred, email isn't deleted, Slack history is preserved. SSO still suspends and licences still reclaim, but the data footprint stays intact until the hold clears. Legal team gets notified when the offboarding runs against a held custodian.

How does it handle voluntary vs. involuntary termination differently?

The termination-type field from HRIS drives timing. Voluntary defaults to standard (24-hour device return window). Involuntary suspends SSO immediately, locks device immediately, and skips the friendly-send-off email. Reduction-in-force (RIF) events additionally handle the mass-offboarding batching and give affected employees a longer email-forwarding window.

What about non-SSO SaaS accounts?

The SaaS management integration (via UIA) discovers accounts through admin-console APIs. For providers without an API, Harry generates a manual-revoke checklist in the security audit report — you get a named list to work down rather than discovering forgotten accounts in a breach post-mortem.

Can we delay the device wipe?

Yes. The default 24-hour countdown is configurable per policy (7 days is common for remote employees). The lock is immediate; the wipe is time-gated to allow physical return.

What if the offboarding fires by mistake?

Every revocation is logged with a timestamp and reversal path. If HR rescinds the termination within the window (before the device wipes), Harry restores SSO, re-provisions the recorded SaaS grants, and restores group memberships. Full audit trail of both the revoke and the restore.

See it run on your data.

Free plan, no credit card. Connect the systems this playbook needs and run it against a past event first.

Book a demoMore HR playbooks