Before
An administrator had to open or update the departure ticket, look up the employee across identity and productivity systems, suspend access, clear sessions, and check mailbox licensing. They also had to review each application separately, coordinate disablement, and copy the resulting statuses back into GLPI.
How it works
- Receive the departure event, check whether it was already handled, and create the GLPI offboarding ticket.
- Identify the employee, suspend sign-in, clear sessions, inspect mailbox licensing, and request conversion when the required licence is available.
- Classify and deprovision selected applications, compile the results into an access checklist, and leave IT only the final AD disablement and explicitly manual or failed items.
Workflow details
- Departure record: The flow receives an employee departure event, builds the employee context, and opens an offboarding ticket in GLPI with the employee identity and contract end date. It also evaluates whether the departure has already been handled and can return an already-handled status.
- Identity shutdown: It locates the employee account, suspends sign-in, and clears active sessions and OAuth tokens so the employee can no longer use single sign-on.
- Mailbox decision: It reads the Microsoft 365 account and licence details, then requests shared-mailbox conversion through the configured runbook only when an Exchange plan is still licensed. If the account is missing or no longer licensed, the checklist records the appropriate manual or unavailable status.
- Application decisions: The flow lists the employee’s active applications and classifies each one. Artis ERP and Crystal CRM are sent through the application-disable sub-flow, while applications managed through identity deactivation or SSO blocking are recorded with their resulting status; unsupported applications are marked for manual action.
- Audit handoff: It compiles statuses for SSO, mailbox, and every application into an HTML access checklist, adds that checklist to the GLPI ticket, and returns the employee email, ticket ID, status, and count of manual or failed items. Final account disablement in AD remains with IT.
What changed
Offboarding actions and their results are assembled automatically from one departure event, with identity, mailbox, and application checks recorded in the GLPI ticket. The handoff now highlights only the final AD disablement and applications or operations marked manual or failed.
Work removed
Opening the offboarding ticket, looking up the employee, suspending sign-in, clearing sessions, checking Exchange licensing, initiating the mailbox conversion request, reviewing active applications, sending supported application-disable actions, and copying access statuses into GLPI.
Expected outcome
A consistent offboarding record with fewer unanswered access questions and up to two application-disable handoffs removed per eligible departure, while final AD disablement and flagged exceptions remain with IT.
