Before
An administrator likely had to search for the employee in the directory, switch between identity, password-management, collaboration, and team tools, and perform each suspension, session reset, or removal separately. The administrator then had to verify what was completed and manually notify the requesting owner or channel.
How it works
- Receive the offboarding request and resolve the employee from the supplied name or email address.
- Suspend the core identity, revoke active sessions, remove the employee from password-management and collaboration access, and evaluate team membership for additional deprovisioning.
- Post a Slack report summarizing the completed actions and timing details.
Workflow details
- Request and identity resolution: The workflow starts from a secure webhook, typically initiated through an internal communication tool. It extracts the requested employee's name or email address, searches the directory when a name is supplied, and resolves the employee's primary email and identity records for downstream actions.
- Core access shutdown: The employee is suspended in Google Workspace and Okta. The workflow also removes active Okta sessions, helping revoke existing identity-provider access rather than only preventing future sign-ins.
- Credential and collaboration cleanup: The employee is located in the password-management directory and removed from the organization. The workflow then finds the corresponding Slack account and resets its active sessions across devices.
- Team-specific deprovisioning: The employee's Okta group memberships are reviewed to determine whether a team-specific action is needed. The flow includes removal paths for users associated with HubSpot or GitHub, based on the configured team decision logic.
- Completion reporting: After the deprovisioning actions, the workflow assembles a Slack message identifying the employee, summarizing the core and team-specific actions, and including timing details before marking the run successful.
What changed
A single webhook request now coordinates employee identity resolution, core account suspension, session revocation, password-management removal, collaboration-session reset, and configured team-specific cleanup. The human handoff changes from executing and verifying each action across separate tools to reviewing the automated Slack completion report.
Work removed
Manually searching for the employee, looking up identity and group records, suspending the user in multiple systems, wiping active sessions, removing the password-management membership, deleting team-specific accounts, copying completion details, and notifying the requesting channel.
Expected outcome
Conservatively, the workflow can replace roughly 8–12 recurring cross-system offboarding actions per employee, depending on the team-specific branch, while producing a consistent completion record in Slack.
