Controlled Employee Offboarding and Access Handoffs

Controlled Employee Offboarding and Access Handoffs

Controlled Employee Offboarding and Access Handoffs

This automation coordinates employee offboarding across identity, devices, mailbox continuity, business applications, and physical handoffs from a single departure request. It revokes access, preserves mailbox continuity, records each action, and routes exceptions to the appropriate service desk team.

Offboarding

Identity Management

IT Asset Management

Service Desk

Trigger

A secure webhook carrying an employee departure request, including the user, manager, service record, and related account identifiers, triggers the flow.

Outcome

The flow produces a fully documented offboarding record with access removals, mailbox status, application freeze, physical handoff task, and either closure or Exchange escalation.

Trigger

A secure webhook carrying an employee departure request, including the user, manager, service record, and related account identifiers, triggers the flow.

Outcome

The flow produces a fully documented offboarding record with access removals, mailbox status, application freeze, physical handoff task, and either closure or Exchange escalation.

Before

An operator likely checked memberships, devices, licences, mailbox status, Salesforce access, and physical handoffs in separate systems. They then copied results into the departure request and manually escalated mailbox or equipment exceptions.

How it works

  1. Start and document the departure request, then revoke sessions, disable the account, and preserve the current access context.
  2. Remove group and device access, freeze Salesforce, process the mailbox conversion, and continue with licence handling only after the conversion check.
  3. Create the physical handoff task and either close the request with a consolidated summary or escalate the Exchange issue while retaining licences.

Workflow details

  • Request tracking: A departure request starts the process, and the service record is updated to show that offboarding has begun, with subsequent actions documented for traceability.
  • Identity and access removal: The workflow revokes active sessions, disables the employee account, records current group memberships, removes the user from each group, retires managed devices, and freezes Salesforce access.
  • Mailbox continuity: The employee mailbox is submitted for conversion to a shared mailbox, with manager access, an automatic reply, and directory hiding configured as part of the mailbox handoff.
  • Decision and escalation: The workflow checks whether the mailbox conversion is confirmed before proceeding with the configured Microsoft 365 licence-removal stage. If conversion is not confirmed, licences are retained and an Exchange escalation is added to the service record.
  • Operational handoff: A task is created for badge deactivation, mobile-line suspension, and equipment recovery, while the main request is summarized and closed on the standard path. The supplied definition uses simulated responses for demonstration.

What changed

Offboarding actions now run from one departure request and are recorded in the service record as they occur. Mailbox conversion is checked automatically before licence handling, while failed conversion and physical handoffs become explicit service tasks instead of informal follow-ups.

Work removed

Manually reviewing group memberships, looking up managed devices and licences, revoking sessions, disabling accounts, removing users from groups, retiring devices, freezing Salesforce access, checking mailbox conversion, updating the service record, creating physical handoff tasks, and notifying Exchange support.

Expected outcome

Each departure can replace several separate system lookups, access updates, and handoff entries with one traceable workflow, while preserving licences when mailbox conversion requires support.

Related flows

Related flows

Explore more workflows with similar topics or tools.

Automated Employee Offboarding

Automates employee offboarding by identifying recently changed employee records, checking whether offboarding is due today, removing qualifying users from Slack, suspending their Google Workspace and Okta access, and sending a detailed status email. This replaces a multi-system manual checklist with a consistent automated sequence.

Automates employee offboarding by identifying recently changed employee records, checking whether offboarding is due today, removing qualifying users from Slack, suspending their Google Workspace and Okta access, and sending a detailed status email. This replaces a multi-system manual checklist with a consistent automated sequence.

Explore use case

Explore use case

Interactive Identity Incident Remediation

This automation turns Teams security event messages into actionable remediation workflows, allowing authorized users to reset passwords, lock accounts, revoke sessions, investigate session identifiers, or route supported requests to specialized subflows. It updates the original incident message with the selected action, actor, and timestamp so the response remains visible in the incident conversation.

This automation turns Teams security event messages into actionable remediation workflows, allowing authorized users to reset passwords, lock accounts, revoke sessions, investigate session identifiers, or route supported requests to specialized subflows. It updates the original incident message with the selected action, actor, and timestamp so the response remains visible in the incident conversation.

Explore use case

Explore use case

Remote Device DNS Resolver Investigation

This automation investigates a remote user's current DNS resolver by retrieving the user's managed device inventory, extracting and parsing resolver data, and comparing it with the authorized resolver. If the resolver is unauthorized, it sends a notification to the initiating Slack channel.

This automation investigates a remote user's current DNS resolver by retrieving the user's managed device inventory, extracting and parsing resolver data, and comparing it with the authorized resolver. If the resolver is unauthorized, it sends a notification to the initiating Slack channel.

Explore use case

Explore use case

Less busywork. More possibility.

Let your agents handle the routine. Make room for what comes next.

Automation intelligence, delivered monthly.

Product releases, automation playbooks, and security research โ€” straight to your inbox. No spam, unsubscribe anytime.

ยฉ 2026 Mindflow โ€” All rights reserved.

SOC 2 Type II
ISO 27001
GDPR
France 2030
Bpifrance
รŽle-de-France

Less busywork. More possibility.

Let your agents handle the routine. Make room for what comes next.

Automation intelligence, delivered monthly.

Product releases, automation playbooks, and security research โ€” straight to your inbox. No spam, unsubscribe anytime.

ยฉ 2026 Mindflow โ€” All rights reserved.

SOC 2 Type II
ISO 27001
GDPR
France 2030
Bpifrance
รŽle-de-France

Automation intelligence, delivered monthly.

Product releases, automation playbooks, and security research โ€” straight to your inbox. No spam, unsubscribe anytime.

ยฉ 2026 Mindflow โ€” All rights reserved.

SOC 2 Type II
ISO 27001
GDPR
France 2030
Bpifrance
รŽle-de-France
To embed a website or widget, add it to the properties panel.