Before
IAM staff had to inspect the account state, suspend active access, revoke sessions, review assigned applications, and update the departure ticket. They also had to create separate equipment and non-SCIM follow-up tasks and notify security about what had been completed.
How it works
- Receive the urgent departure ticket, read the account, and branch based on whether the account is active.
- For an active account, suspend access, revoke sessions and OAuth tokens, and inventory assigned applications; for an inactive account, record that no suspension was required.
- Create follow-up tasks, log the actions on the ticket, and notify security of the containment status.
Workflow details
- Trigger and account check: The workflow starts when an urgent departure ticket is received. It reads the associated account and determines whether it is active or already inactive.
- Inactive-account path: If the account is already inactive, the workflow records that no suspension was made and indicates that remaining SSO accounts should be checked manually.
- Immediate containment: For an active account, it suspends the account, revokes sessions and OAuth tokens, and retrieves the applications assigned to the user. This provides the information needed to identify access that may require additional handling.
- Follow-up and communication: The workflow opens high-priority tasks for equipment retrieval and remote clearing, plus non-SCIM application deactivation, logs the containment actions and task references on the departure ticket, and posts the result to the security identity-and-access channel in Teams. Equipment wiping, restitution, and other non-SCIM deactivation remain operator-owned follow-up activities.
What changed
Account-state validation, immediate containment, application inventory, task creation, ticket logging, and security notification now occur from one urgent-departure trigger. Human operators receive defined follow-up tasks for equipment handling and non-SCIM access instead of assembling the handoff themselves.
Work removed
Manually checking account status, suspending the account, revoking sessions, reviewing assigned applications, creating equipment and non-SCIM follow-up tasks, updating the departure ticket, and notifying security.
Expected outcome
For an active-account run, at least four recurring operator actions are automated—account suspension, session revocation, follow-up task creation, and security notification—while equipment wiping and non-SCIM deactivation remain tracked for human completion.
