Employee offboarding
Quick answer
This project automates offboarding: on a termination event, SailPoint disables accounts and revokes all access quickly, closing the orphaned-account risk.
Key takeaways
- Trigger from a termination event
- Disable then remove accounts
- Revoke all roles and entitlements
- Produce an audit trail
Offboarding (the leaver process) is the single most important security automation in identity governance, because lingering access after departure is both a top audit finding and a real breach vector. This project ensures that when someone leaves, their access is removed promptly and completely.
The goal
On a termination event, SailPoint should disable accounts immediately to stop access fast, then fully deprovision as cleanup completes, leaving no orphaned access and a complete audit trail.
How to build it
- Detect termination via a lifecycle event from the authoritative source.
- Disable accounts immediately to cut access without waiting for full cleanup.
- Revoke all roles and directly-held entitlements across every connected system.
- Handle owned items, reassign or archive mailboxes, files and any resources the person owned.
- Record every revocation as audit evidence.
Design considerations
The key design tension is speed versus grace. Immediate disable protects the organisation the moment someone leaves; graceful deprovisioning then handles data ownership, mailbox delegation and manager reassignment. Decide the sequence and timing deliberately, and make sure the leaver process covers every connected system, an un-onboarded application is exactly where orphaned access survives.
Common pitfalls
- Slow or partial revocation leaving orphaned accounts.
- Missing systems not covered by the leaver process.
- No handling of owned data (mailboxes, files) on departure.
Want to learn this properly?
Our live, instructor-led SailPoint Training covers this hands-on, with real projects and a certification path.
Check your understanding
What triggers offboarding?
- A. Orphaned accounts and standing access after departure.
- B. Immediate disable stops access fast while cleanup completes.
- C. A termination event from the authoritative source.
Show answer
C. A termination event from the authoritative source.
A termination event from the authoritative source.
Why disable before delete?
- A. Orphaned accounts and standing access after departure.
- B. Immediate disable stops access fast while cleanup completes.
- C. A termination event from the authoritative source.
Show answer
B. Immediate disable stops access fast while cleanup completes.
Immediate disable stops access fast while cleanup completes.
What risk does it close?
- A. A termination event from the authoritative source.
- B. Orphaned accounts and standing access after departure.
- C. Immediate disable stops access fast while cleanup completes.
Show answer
B. Orphaned accounts and standing access after departure.
Orphaned accounts and standing access after departure.