Offboarding a departing employee means touching a bunch of different systems, and doing it by hand is both slow and easy to get wrong. How do I automate user offboarding across multiple systems in 3B? I’m curious how to coordinate all those steps reliably and make sure nothing gets missed. A view of the recommended pattern would be really helpful.
Offboarding is a great automation target: high-stakes and repetitive, and missing one system leaves an active account behind. Here’s the recommended pattern.
One trigger, one identity. Kick off from a single event (an HR status change, a ticket, a form). Resolve the person to a canonical identifier you can match across every system, since they may be a different username in each. Get that mapping right up front.
Fan out across systems. Disable the IdP account, revoke SSO and app access, reclaim licenses, lock devices, handle the mailbox, remove group memberships, rotate shared credentials. Each is an authenticated call, one per connector so keys are injected. Run independent actions in parallel; where order matters, kill authentication first (IdP and SSO), then work through the systems behind it.
Make it reliable, because “mostly worked” isn’t good enough here:
- Isolate each step so one failure doesn’t abort the rest. Catch errors as data and keep going.
- Track per-system outcome (done, failed, skipped). That’s your proof and your to-do list.
- Make actions idempotent so re-running to mop up failures can’t cause harm.
- Retry transient errors, but not a genuine “no such user.”
Close the loop. Roll the results into one summary and post it somewhere: who was offboarded, every system’s status, and anything that failed and needs a human. Route failures to a person explicitly rather than dropping them, and log the whole run for the audit trail.
Short version: one trigger resolved to a canonical identity, a deliberate fan-out with auth killed first, each step isolated and idempotent, and a rolled-up summary that surfaces anything left undone.