Automate Employee Offboarding and Access Removal
When someone leaves, two dozen systems are involved – and three different moments: immediately, on the leaving date, once the retention period ends. We build the removal plan that triggers every step at the right time and logs it.
A departure has three moments, not one
A departure is not one event but two dozen small ones that belong to nobody in particular. IT knows the accounts it created itself. Sales knows who holds the login for the tender portal. Finance holds a signing authority at the bank that never appeared on any IT list. Only when somebody leaves does it become obvious that a complete list of the systems this person holds an account in exists nowhere – and that it cannot be assembled in an hour on their last working day.
The real difficulty, though, is not the list but the timing. A departure has three moments. When HR confirms the notice, elevated rights have to go: administrator roles, payment approvals, the right to export whole customer lists. The person then carries on working perfectly normally for another three weeks. On the leaving date, sign-in is blocked, running sessions are ended, the mailbox is handed over. And only once the retention periods have expired may anything be deleted – some after six months, some after ten years, some never.
Collapse those three moments into one and you get it wrong in both directions. Block too early and the last few weeks are worked through a colleague's login; the exception becomes a shared password that survives for three years. Remove too late and accounts stay active for months after the leaving date with nobody feeling responsible for them. On top of that sits the part no interface solves – the access card, the laptop, the fuel card, the mobile number the customer has saved. So we do not build a delete button. We build a plan that gives every step a moment and an accountable person, and records both.
Which departures the plan covers
We start with the type of departure that occurs most often at your company. Every further type later shares the same system list and the same three stages.
Planned departure with notice period
The most common case and the one the plan helps most with: there is lead time, so every step gets its own date instead of one shared deadline.
Garden leave and summary dismissal
Everything moves to the same moment: rights, sign-in, building access. The plan knows this mode and pulls the steps forward rather than skipping them.
Internal move instead of a leaver
The person stays, the rights change. The harder case in practice, because nothing is deleted while plenty should be withdrawn – and rarely anyone notices.
Contractors, interns, agency staff
Time-limited access with an expiry date. The group forgotten most often, because it never appeared on the payroll list.
Mailbox, files and customer contact
What happens to email, storage and open matters: forwarding, access for the successor, deletion after your retention period.
Devices, keys and licences
Laptop, work phone, access card, fuel card: return with a deadline, a signature and escalation to the line manager when nothing comes back.
A removal plan as it actually looks
A planned departure on 31 August, released by HR on 12 August. Three moments, each showing what the plan executes itself and what a person has to sign off.
| System | What happens | Execution |
|---|---|---|
| Immediately · when HR releases the leaver12 Aug, 09:14 | ||
| Entra ID | Roles ‘administrator’ and ‘payment approval’ removed, account stays active | automated |
| CRM | Full list export and bulk send blocked, read access remains | automated |
| Online banking | Signing authority withdrawn – portal has no interface, deadline 1 day | person signs off |
| On the leaving date · 18:0031 Aug, 18:00 | ||
| Entra ID / Microsoft 365 | Sign-in blocked, all sessions and tokens revoked, password reset | automated |
| Mailbox | Converted to a shared mailbox, forwarded to the successor for 30 days | automated |
| Laptop & work phone | Work profile wiped remotely, return signed off on collection | person signs off |
| Access card & alarm code | Access control has no interface: task for reception, handover on the last day | person signs off |
| Time recording | Account disabled by the key user, ticket with deadline and reminder | person signs off |
| After the retention periodfrom 28 Feb | ||
| Mailbox & OneDrive | Deleted after 6 months, licence freed – the date sits in the plan | automated |
| Personnel file | Access ended on the leaving date, deletion blocked until 31 Dec 2036 | blocked |
| Backups | Mailbox cannot be removed individually, drops out with the 90-day cycle | not possible |
- automated The plan carries out the step itself
- person signs off Task with a deadline, escalated when it expires
- blocked Deletion ruled out by the retention period
Every row is logged with a timestamp, the executing account and the result.
The first stage is the one that matters. Put everything on the leaving date and payment approvals and export rights survive three weeks longer than they need to.
The personnel file deliberately sits on blocked: it may not be deleted for ten years. Access for the person who left still ends on the leaving date – retaining data and withdrawing access are two separate steps.
From the HR trigger to the final deletion
-
Record the system list
A one-off exercise: which systems exist, who owns each one, which offer an interface and which retention period applies. That list is the real outcome of the first workshop – in most companies it did not exist before.
-
Take the trigger from the HR system
Personio, HRworks or your staff list supply the name, leaving date, type of departure, line manager and successor. Nothing starts without that release; there is exactly one triggering source, not three.
-
Run the ‘immediately’ stage
The moment HR releases the leaver, elevated rights fall: administrator roles, payment approvals, export and bulk-send permissions. The account itself stays active so the person can work until their last day.
-
Run the leaving date
At the defined time on the leaving date: block sign-in, revoke sessions and tokens, convert the mailbox into a shared one, set forwarding. Every system without an interface produces a task with a deadline and an owner.
-
Watch the deadlines and log everything
The plan stays open after the last working day: forwarding ends after 30 days, mailbox and licence after your retention period. Every step is recorded with a timestamp, the executing account and the result.
What changes day to day
Today
- Nobody can say which systems the person held accounts in
- Everything hangs on a Word checklist somebody would have to maintain
- Rights fall on the leaving date – or three months later
- Hardware returns quietly fade away until somebody chases them
- For an audit there is no evidence, only recollections
With a removal plan
- The system list exists and is walked through at every departure
- The plan is generated from leaving date, role and type of exit
- Elevated rights fall at once, sign-in only on the leaving date
- Returns have a deadline, a signature and an escalation step
- Every step is logged with a timestamp and the account used
What a removal plan cannot do
Offboarding looks like a purely technical job. We clarify these four points before quoting, because they decide whether the build pays off for you:
- Without a maintained system list the plan runs empty. Access can only be withdrawn where an account is recorded somewhere – a tool one department signed up for three years ago appears in no interface. Creating that list and keeping it current stays your job; we supply the structure, the workshop that captures it and the annual reconciliation, not the knowledge itself.
- Not every system has an interface. Access control systems, banking portals, machine controls and older industry software often have to be operated by hand. There the plan raises a task with a deadline, an owner and a signature – but a human still has to do the work. If most of your systems look like that, the automation mainly moves the bookkeeping about the work, not the work.
- With only a handful of leavers a year the build does not pay for itself in time saved. If you say goodbye to two people a year you are better served by a carefully maintained checklist, and we will tell you so in the intro call. The reason to do it anyway is evidence: an audit, a data processing agreement or a dispute demands a trail that a Word document cannot provide.
- Withdrawing access and deleting data are two different things with separate deadlines. Payroll and tax records must be retained, backups can rarely be cleaned up individually, and whether a mailbox may be deleted after six months is not a decision software makes. We implement the periods you give us – the legal assessment stays with you, your data protection officer or your advisers.
Fits your systems
Scope and price
The entry price covers one departure flow with your system list and the three stages. What moves the price, we say before the quote.
- System list with owner, interface and retention period per system
- Your HR system connected as the single triggering source
- Removal plan in three stages: immediate, leaving date, after retention
- Automated removal in Entra ID and Microsoft 365
- Tasks with deadline, signature and escalation for everything manual
- Log per step with timestamp, account and result
- Documentation, handover for HR and IT plus 30 days of support
What increases the price
- More than roughly ten systems with their own connection
- Access control, banking or industry systems without an open interface
- Several legal entities or sites with their own rules
- Internal moves as a separate flow with a rights comparison
- Evidence for ISO 27001 or TISAX in a prescribed format
Several sites, access control systems without an interface and evidence for ISO 27001 typically land in the range of our Workflow Advanced package from €2,490. We quote the binding fixed price after the intro call.
All prices excl. VAT · operation and further development optionally via a support package
What you get
-
Production removal plan
Set up from the HR trigger to the final deletion date and signed off against two real departures
-
System list as a working document
Per system: owner, moment, interface or manual step, retention period
-
Audit log
Every step with timestamp, executing account and result, exportable as a list
-
Handover for HR and IT
How garden leave is triggered, who gives the second approval and what happens when a step fails
Frequently asked questions about offboarding
These solutions fit alongside
Automated Employee Onboarding
The same system list in the other direction: accounts, devices and rights ready on day one.
IT Asset Management & Tracking
Which device sits with whom – the basis for every return request when someone leaves.
Approval Workflows
The second approval for garden leave and for access to someone else's mailbox.
Applicant Tracking Automation
Backfilling starts the moment the resignation is recorded in the HR system.
Do you know where your last leaver still has an account?
In the free intro call we walk through your most recent departure: which systems were involved, who did which step and what is still open today. Afterwards you know whether a removal plan carries at your number of leavers.
Book a free intro callWhere employee offboarding creates value in everyday work
Access, devices, responsibilities and knowledge are revoked, returned or transferred in a coordinated way when an employee leaves.
Three concrete operating scenarios to compare with your own process.Remove access on time
Accounts, groups and applications are processed at the approved time.
Recover assets
Devices, keys and licences receive owners, deadlines and return status.
Transfer knowledge
Open customers, projects and documents are assigned in a structured way before departure.
A strong fit when …
People-related tasks repeat, several teams are involved, and deadlines or access rights must be coordinated transparently.
- You handle recurring offboarding tasks using repeatable rules.
- The intake, target system and accountable business role can be named clearly.
- Exceptions are allowed to remain visible and move to people deliberately.
Deliberate automation boundary
Immediate action, employment-law decisions and access to personal content remain with HR, security and management.
Explore the technical approach and platformsEstimate time savings with your own volume
The calculator uses 18 minutes today and 5 minutes after automation as fixed example assumptions. It does not replace process analysis.
Illustrative estimate based on the visible assumptions — not a guarantee.