SailPoint Employee offboarding
A leaver project: revoke all access promptly and completely on termination.
This project automates offboarding: on a termination event, SailPoint disables accounts and revokes all access quickly, closing the orphaned-account risk.
- Trigger from a termination event
- Disable then remove accounts
- Revoke all roles and entitlements
- Produce an audit trail
Offboarding (the leaver process) is the single most important security automation in identity governance, because lingering access after departure is both a top audit finding and a real breach vector. This project ensures that when someone leaves, their access is removed promptly and completely.
The goal
On a termination event, SailPoint should disable accounts immediately to stop access fast, then fully deprovision as cleanup completes, leaving no orphaned access and a complete audit trail.
How to build it
- Detect termination via a lifecycle event from the authoritative source.
- Disable accounts immediately to cut access without waiting for full cleanup.
- Revoke all roles and directly-held entitlements across every connected system.
- Handle owned items, reassign or archive mailboxes, files and any resources the person owned.
- Record every revocation as audit evidence.
Design considerations
The key design tension is speed versus grace. Immediate disable protects the organisation the moment someone leaves; graceful deprovisioning then handles data ownership, mailbox delegation and manager reassignment. Decide the sequence and timing deliberately, and make sure the leaver process covers every connected system, an un-onboarded application is exactly where orphaned access survives.
Common pitfalls
- Slow or partial revocation leaving orphaned accounts.
- Missing systems not covered by the leaver process.
- No handling of owned data (mailboxes, files) on departure.