Home · Solutions · Other solutions
Solution · Other solutionsThe termination date closes the accounts, not an email somebody remembers to send
Every access and device of a leaver closed on the last day
Every account, licence, mailbox and device a leaver could reach is closed on the termination date, with a per-system record that survives an audit.
Executive summary
A disabled account is not the same as closed access. The long tail is where audit findings come from.
The design rests on one principle: a date drives the process, not an email.
Access ends on the termination date, because a date drives the process instead of an email somebody remembers to send.
Microsoft Entra ID and Entra ID Governance; Microsoft Intune; Exchange Online and OneDrive through Microsoft Graph
Business problem
Offboarding
Offboarding fails quietly because it is spread across owners who never share a list. HR holds the termination date, IT holds the identity, application owners hold their own systems, and the only person who knows which shared mailboxes, customer portals and small tools the leaver actually used is the manager, who is rarely asked in time.
Disabling the Entra ID account closes single sign-on, and single sign-on was never the whole estate. Local logins in the policy-administration system survive, API tokens keep working, a folder shared with a customer stays shared, and a mailbox forwarded to the manager "for a while" is never reviewed again. Licences stay assigned because reclaiming them is another ticket nobody raised.
At scale the pattern becomes structural. Six countries mean six local variations remembered by different engineers, and each acquisition adds systems that were never in anyone's catalogue. The reason none of it gets fixed is simple: a leaver never calls the service desk to report that their access still works.
How it works today
What we usually find is a checklist that lives in three places and is owned by nobody.
- PersonHR records the termination date in Workday and emails IT "please offboard", sometimes after the last day
- SystemIT disables the Microsoft Entra ID account, closes the ticket and reports the leaver as done
- PersonThe manager is asked which other systems the person used and lists the ones they remember
- WaitingApplication owners remove local accounts when they get to the email, which can take weeks
- WaitingLicences are reclaimed at the quarterly clean-up, if anyone runs it that quarter
- Risk of errorThe mailbox is forwarded to the manager and the laptop chased with a return label; neither has an end date
- Risk of errorInternal audit samples leavers, finds accounts that outlived their owners, remediation starts
Why the current process costs more than it appears
The most expensive part of this process has no cost line.
- Two hours of IT and HR time per leaver is the visible cost and the only one anybody budgets. The invisible one is standing risk: an account that outlives its owner is a door nobody watches, and the first news of it is a finding or an incident.
- Licences of departed people keep being paid, because the person who would notice is the one running the quarterly clean-up that keeps slipping.
- Managers pay a tax that appears in no report: chasing the laptop, rebuilding the access list for the successor, answering questions about a colleague who left in March.
- A mailbox forwarded "for a while" becomes a data-protection question the day a customer asks who has been reading their correspondence.
- Every audit finding costs more than the fix, because it brings a remediation plan, a re-test, a management letter and a follow-up cycle.
Cost of inaction
Leavers generate no complaint, which is the whole difficulty. The population of accounts that outlived their owners grows by about thirty a month and produces no signal until an auditor samples it or somebody uses one. The second row is the honest one, because manager chasing and audit remediation are paid in ten-minute pieces no cost centre records.
Two things get worse rather than staying flat. Turnover rises in the years a company can least afford it, so leaver volume peaks when IT is short-handed, and every acquisition brings systems with local accounts, no SCIM and no named owner. A repeat finding that hardens into a control deficiency in the management letter is a different conversation with the board than a housekeeping item.
A plausible organisation with realistic proportions. The figures are there to be recalculated on your data; they are not a client result.
An illustrative insurance broker, 1,900 employees in six countries. Workday is the HR system of record, Microsoft Entra ID gives single sign-on to most tools, a policy-administration system and a claims portal use local accounts, sales works in Salesforce, laptops are enrolled in Microsoft Intune, tickets run in ServiceNow.
About 30 leavers a month, roughly 360 a year, handled by two IT engineers and one HR partner from a Word checklist last updated two years ago. Internal audit has raised leaver access as a repeat finding.
HR emails IT, IT disables the identity, the manager is asked for the rest, application owners act when they read their mail. Nothing distinguishes "ticket closed" from "access gone".
About 145 minutes of manual work per leaver across IT, HR and application owners, plus 25 minutes of manager time chasing the device and rebuilding the successor's access list.
The termination date in Workday becomes the master clock. Microsoft Entra ID Governance runs the leaver workflow on the last day, robots close the accounts in systems without SCIM, Microsoft Intune retires the laptop, and every step lands in a leaver record.
In the modelled case manual effort per leaver drops to the exception share, access closes on the termination date rather than in the following weeks, and internal audit receives a complete population with timestamps instead of a sample. Nothing here was measured at a client; it is what the model produces.
Proposed solution
The design rests on one principle: a date drives the process, not an email. When Workday records a termination, UiPath Integration Service picks up the event and opens a leaver record in UiPath Data Fabric, with every step scheduled backwards from the last day. Microsoft Entra ID Governance then runs its leaver lifecycle workflow on the termination attribute: groups and Teams memberships removed, account disabled, licences reclaimed.
The long tail is the part a ticket never covers, and it is where most of the work sits. UiPath Robots deactivate the Salesforce user, revoke the local accounts in the policy-administration system and the claims portal, convert the mailbox with a fixed expiry date, transfer the OneDrive contents to the manager and instruct Microsoft Intune to retire the laptop on return. Which systems exist and who owns each of them stops being folklore: it becomes an application register in Microsoft Lists, maintained by the owners and reconciled against what the last hundred leavers used.
People appear where judgement is needed and nowhere else. Before the last day a task in Microsoft Teams asks the manager to confirm the systems used and who inherits the files and the mailbox; a device-return task with a courier label goes to the leaver. Immediate terminations follow a separate path only security can trigger. The report then shows, person by person and system by system, what closed and when.
Microsoft Entra ID Governance lifecycle workflows on the termination attribute; Microsoft Intune retire and wipe; Exchange Online shared-mailbox conversion and OneDrive transfer through Microsoft Graph; UiPath Orchestrator queues, triggers and audit log; UiPath Action Center tasks completed inside Microsoft Teams
The backward schedule, the application register, robots for every system without SCIM, the leaver record in UiPath Data Fabric, the manager and device-return tasks, the immediate-termination path and the leaver report
UiPath Integration Service connectors for Workday, Salesforce, ServiceNow and Microsoft Teams; UI automation for the policy-administration system and the claims portal, neither of which exposes an API
How the automated process works
- AutomationA termination date in Workday opens the leaver record and schedules every step backwards from the last day
- PersonThe manager confirms in Microsoft Teams which systems the person used and who inherits the files and the mailbox
- AutomationThe day before, sensitive access is removed and a device-return task with a courier label goes to the leaver
- SystemOn the last day the Entra ID Governance workflow disables the account, strips groups and reclaims licences
- AutomationRobots deactivate the Salesforce user, revoke local accounts, convert the mailbox with an expiry date and transfer the OneDrive files
- SystemMicrosoft Intune retires the laptop on return, and the wipe is recorded against the leaver
- AutomationAnything open after the last day becomes a task for the named system owner; the report closes when the last line is green
Human-in-the-loop model
Automation handles
- Scheduling every step from the termination date and re-planning when HR moves it
- Disabling the identity, removing groups and reclaiming licences on the last day
- Revoking local and SaaS accounts, recording each system's state before and after
- Converting the mailbox, transferring the files and retiring the device
- Producing the leaver report and escalating whatever is open past the last day
People decide
- Managers confirm the systems used and who inherits the files and the mailbox
- Security sets the sequence for immediate terminations and high-risk roles
- HR approves exceptions such as access extended for a handover
- IT investigates systems the register does not yet know about
Before and after
Systems and integrations
Everything below runs on licences and systems you already hold, or would need anyway.
Inputs
- Workday termination events
- the application register in Microsoft Lists
- ServiceNow offboarding tickets
- manager confirmations from Microsoft Teams
Automation layer
- UiPath Orchestrator
- UiPath Robots
- UiPath Integration Service
- UiPath Action Center
- UiPath Data Fabric
Target systems
- Microsoft Entra ID and Entra ID Governance
- Microsoft Intune
- Exchange Online and OneDrive through Microsoft Graph
- Salesforce
- the policy-administration system and the claims portal
Human touchpoints: manager confirmation task in Microsoft Teams; device-return task for the leaver; security approval for immediate terminations; the leaver report
Technologies used
runs the leaver template on the termination attribute: groups removed, account disabled, licences reclaimed
Arevoke local accounts, deactivate the Salesforce user, queue every step, retry and log it
Areads the termination event and drives every system with an API
Aretires or wipes the enrolled laptop once returned, and records the result
Amanager confirmation, device-return and security tasks completed without leaving Teams
Athe leaver record: one row per system, state before and after, timestamped
Athe application register: system, owner, revocation method, review date
Aholds and rotates the scoped robot credentials
AIllustrative economic model
A model, not a promise.
Six of the thirty monthly leavers stay with people in this model, so the calculator runs on the remaining 24; the 80 % automatable share is folded into the volume rather than applied afterwards. 145 minutes is the combined IT, HR and application-owner effort per leaver, €52 a fully loaded hourly cost across those three roles. Two pools sit outside the calculator on purpose: 25 minutes of manager time per leaver at €68 an hour, and four audit remediation cycles of 30 hours at €62 an hour. Nothing here was measured at a client, and orphaned licence cost is excluded because it depends on your contracts.
Run the numbers on your data
An illustrative estimate from your own inputs. It models released capacity; it is not a promise of savings.
Business benefits
- Access ends on the termination date, because a date drives the process instead of an email somebody remembers to send
- Licences are reclaimed the same day, which finance sees on the next invoice rather than after the quarterly clean-up
- Internal audit receives the whole population with timestamps, so the leaver review stops being a reconstruction
- Managers stop being the inventory: what a person could reach comes from the register and the systems, not from memory
- Devices come back sooner because the return task is issued before the last day, courier label attached
- The same process runs in all six countries, with local variations written as rules instead of remembered
The management view
- Each leaver has a closed list, and exceptions are visible while they can still be fixed rather than a year later
- Slow systems become identifiable by owner, which turns "IT is slow at offboarding" into a named queue with a number
- Security gains a service level it can report: hours from termination to last access closed, per leaver, every month
- The process survives the people who run it, because the register and the record are company assets
Board-level KPIs
Security and governance
The automation holds exactly the rights it needs, and not one more.
- Each robot account carries one right and no more: a Salesforce profile that deactivates users and reads nothing else, an Exchange Online application permission scoped to named mailboxes, an administrative user in the policy system with no access to policy data
- Secrets never sit inside a workflow. They are held in Azure Key Vault, reached through the Orchestrator credential store, and rotated on a schedule the security team sets
- Immediate terminations run on four eyes: security triggers, the process executes, HR is informed, and the sequence is fixed in advance instead of improvised on the phone
- Every revocation is written with its before and after state to the leaver record and the Orchestrator audit log, retained under a Microsoft Purview label; the record holds account identifiers, not content
- Processing stays inside your Microsoft 365 tenant within the EU Data Boundary, and the robots run from the EU region of UiPath Automation Cloud
Why now
Financial entities in the EU are now expected to demonstrate access lifecycle control rather than describe it. DORA and NIS2 place access management inside an audited risk framework, and a policy document is not evidence where a report with timestamps is
Microsoft Entra ID Governance lifecycle workflows trigger on the termination attribute, so the identity half becomes configuration and the effort moves to applications outside single sign-on, where robots earn their keep; the feature needs Entra ID Governance or Entra Suite licensing, a budget line worth confirming early
The modelled €3,016 a month is the smaller argument. The larger one is that every month of delay adds another thirty people to a population of open accounts nobody can list
Relevant executive roles
Orphaned accounts are the cheapest way into a company, and this closes them on a date instead of on a reminder
One process for six countries and every acquired entity, with a service level that can be reported rather than defended
HR triggers offboarding once, in the system it already uses, and stops mediating between IT and managers
The leaver review moves from a sample and a reconstruction to a complete population with timestamps
Common questions and objections
That closes single sign-on, which was never the difficult part. Local accounts, API tokens, mailbox delegations and hand-created SaaS users all survive it, and the long tail is what this process exists for.
Then the process starts from the ticket and back-fills, and the report shows how often the date arrives late and from which country. That data is what finally fixes the upstream habit.
They should. Each robot gets one scoped right, a vaulted credential and a log line per action: a smaller exposure than an engineer holding global administrator and a Word checklist.
When this is not the right solution
- Fewer than about five leavers a month with a small estate fully connected to single sign-on; a checklist is cheaper
- No HR system of record. If the termination date lives in an email, that is the thing to fix first
- An identity governance platform already covering the whole estate; then we build only the robots for what it cannot reach
A question for the next management meeting
Nobody here can name the systems last month's leavers could still open today; what would it take to turn that list into a monthly report instead of an investigation?
Implementation approach
The first week looks the same at every client: we look at the data.
We deliver
- An access inventory rebuilt from the last hundred leavers: systems actually used, owner of each, revocation method
- The application register in Microsoft Lists, with an owner and a review date per system
- Configuration of the Entra ID Governance leaver workflow and the group and licence rules behind it
- Robots for the systems without SCIM, including the two that expose no API at all
- The leaver record in UiPath Data Fabric, the Teams tasks and the leaver report
- Pilot in one country with the old checklist alongside, then rollout with hypercare and a runbook
We need from you
- Termination dates maintained in the HR system, and someone who owns their quality
- Application owners who accept a robot deactivating users in their system
- Microsoft Entra ID Governance or Microsoft Entra Suite licensing for the accounts in scope
- Test accounts and a pilot country with a named process owner
Stages
Discovery
Rebuild the access inventory and name an owner for every system
Design
Backward schedule, immediate-termination path, approval points, security model
Build
Lifecycle workflow, robots, register, leaver record and Teams tasks in your tenant
Validation
Replay of real leavers, exception handling, sign-off by IT, HR and security
Go-live
One country first, old checklist alongside until the report is trusted
Optimisation
Monthly review of items open past the last day; new systems added to the register
Departmental. Effort is driven by the number of systems outside single sign-on, how many expose an API, and whether the HR system holds a termination date anyone trusts.
An account that outlives its owner is a control failure. You choose where you find it.
Give us the last twenty leaver tickets and the systems those people touched. You get back a system-by-system count of how many days each access outlived its owner, plus a short read-out naming the two systems worth automating first.
Check your last twenty leaversThe neighbouring process usually has the same problem
New starters wait days for access; leavers keep theirs for weeks. Both are the same missing handover.
View solution IT & servicesEvery laptop accounted for, from order to wipe certificateHardware ordered by email, handed over without a record, and written off when the auditor asks.
View solution Other solutionsDay one ready: accounts, access and kit from one HR triggerNew hires wait days for roles and laptops because onboarding is five processes held together by email.
View solutionIndustries we deliver this in most oftenManufacturing & industryTransport & logisticsServices & ITShared services