Automate employee offboarding across every app
Stepwork starts offboarding when HR records a termination, closes every app including ones without SCIM, hands files to the manager, and records when access ended.
- Use case
- Employee offboarding across every appPeople
- Best for
- IT Manager, People Ops Lead, IT Administrator
- Applications used
Workday
Microsoft Entra ID
Okta
Google Workspace
Ramp
- Business outcome
- Access closed in every app on the day they leave
The problem
One termination in HR, then every admin console by hand
- Watch the HR system for terminations, then open a ticket
- Disable the account in the identity provider
- Remove them from every app SSO and SCIM don't reach
- Transfer files, records, and recordings to the manager
- Lock the laptop and suspend the company card
- Piece together when access ended once an auditor asks
Triage
However a departure arrives, it lands in the right procedure
Departures show up as an HR record, a manager's message, a ticket, or a contract end date nobody is watching. Stepwork reads each one where it arrives and starts the procedure that handles it.
How it arrives
- WorkdayTerminationTermination · Involuntary
Worker: Dana Reyes · Sales
Effective: today, 2:00 PMGoes to Full offboarding
BambooHRStatus changeStatus: Resigned Employee: Marcus Lee · Finance Last day: FridayGoes to Full offboarding
DeelContract endContract ended · Oct 31 Contractor: Ravi Patel · Design Extension: none recordedGoes to Contractor end dates
SlackSlack messagefyi the agency team wraps up end of month, can someone make sure their logins stop?Goes to Contractor end dates
Microsoft TeamsTeams messagePriya's last day is the 14th. Can finance stop her card and check for open expenses?Goes to Finance close-out
FreshserviceOffboarding ticketSubject: Offboarding · J. Okafor
Please move his Drive and Dropbox files to Lena before the account goes.Goes to File handover
Where it goes
Systems
Every place a leaver still has access
Your HR system says who left, and your identity provider closes the accounts it manages. Everything else still takes a person: apps without single sign-on or SCIM, the files they own, the laptop, and the company card. Stepwork works through those screens with a login your team grants.
- HR and contractor records: Workday, BambooHR, Rippling, ADP Workforce Now, Deel
- Identity and devices: Microsoft Entra ID, Active Directory, Okta, JumpCloud, Microsoft Intune, Jamf, Kandji
- Apps with accounts and files to close: Microsoft 365, Google Workspace, Slack, Salesforce, GitHub, Zoom, Dropbox, Figma
- Apps without single sign-on or SCIM: Internal tool, On-prem app, Vendor portal
- Cards, expenses, and payroll: Ramp, SAP Concur, Expensify, Paychex Flex, Gusto
Example procedures
Four offboarding procedures, card by card
One runs the whole offboarding when HR records a termination, one sweeps contractors past their end date, one closes out cards and expenses, and one hands a leaver's files to their manager. Swap in your HR system, identity provider, or chat tool above each one and the steps stay the same.
Offboard a leaver across every app when Workday records the termination
When a termination takes effect in Workday, Stepwork deactivates the account in Microsoft Entra ID, locks the laptop in Microsoft Intune, and closes or hands over the leaver's account in every app on your list. A same-day exit has its sessions ended first, and the checklist lands in Microsoft Teams.
- Workday
- Microsoft Entra ID
Microsoft Intune
Internal tool- Microsoft Teams
Swap in your systemsThe steps stay the same. Only the screens change.
Offboard a leaver across every app when Workday records the termination
Webhook
Termination takes effect in Workday
status changed · terminated
Output variables
- employee_email
- manager_email
- exit_type
Rule logic
Is it a same-day exit?
Input variables
- exit_type
Paths
- If the exit is involuntary or HR made it effective immediatelyThen: End every session in Microsoft Entra ID
- OtherwiseThen: Deactivate the account in Microsoft Entra ID
Execution
If same-dayEnd every session in Microsoft Entra ID
Input variables
- employee_email
Output
- sessions_ended
Execution
Deactivate the account in Microsoft Entra ID
Input variables
- employee_email
Output
- account_status
Execution
Lock the laptop in Microsoft Intune
Input variables
- employee_email
Output
- device_status
Execution
Close or hand over their account in the app
Input variables
- employee_email
- manager_email
Output
- app_result
Execution
Post the offboarding checklist in Microsoft Teams
Input variables
- account_status
- device_status
- app_result
- sessions_ended
Drag to explore · pinch to zoom
Step by step
- The termination comes inHR records the exit in Workday the way it always does. The run starts when it takes effect: at once for a same-day exit, or on the date HR set for a planned one. Nobody in IT has to notice it first.
- The rule checks the timingIf the exit is involuntary or effective immediately, the run takes the top path. A planned exit goes straight to the deactivation.
- If same-dayEnd every session in Microsoft Entra ID
- If a planned exitDeactivate the account in Microsoft Entra ID
- Open sessions end firstOnly on a same-day exit: the recorded flow signs the leaver out of every session in Microsoft Entra ID, so a browser left open stops working before anything else runs.Only on this path: If same-day
- The account gets deactivatedBoth paths meet here. The recorded flow deactivates the account in Microsoft Entra ID, which ends sign-in to every app behind single sign-on.
- The laptop gets lockedStepwork finds the leaver's laptop in Microsoft Intune and locks it, so the device and what's on it stay safe until it comes back.
- Every other app gets closedInside the solid frame, Stepwork works through each app on your access list, including the ones Microsoft Entra ID doesn't manage. It finds the leaver in the admin console, transfers what they own to their manager where the app needs it, then deactivates the account.Repeats: For each app on the access list · 22 apps
- IT and HR get the checklistAfter the last app, the checklist goes to the offboarding channel in Microsoft Teams: each app, what was done, the time, and anything that needs a person.
Field map
| From | To |
|---|---|
| WorkdayTermination: work email, exit type | Microsoft Entra IDUser: deactivateSessions end first on a same-day exit |
| WorkdayTermination: manager | Internal toolRecords ownerBefore the account is closed |
| Microsoft IntuneDevice: lock status | Microsoft TeamsOffboarding checklist |
Suspend contractors in Microsoft Entra ID once their end date in Deel passes
Every morning Stepwork reads the contractors in Deel whose end date has passed, suspends each one in Microsoft Entra ID, and tells their manager in Microsoft Teams. IT gets the list.
- Microsoft Entra ID
- Microsoft Teams
Swap in your systemsThe steps stay the same. Only the screens change.
Step by step
- The ended contracts come inStepwork reads each contractor whose end date in Deel has passed, with the manager who brought them in. Each one found is one pass through the loop.
- The account gets suspendedInside the dashed frame, the recorded flow suspends the contractor in Microsoft Entra ID rather than deleting the account, so it can come back if the contract was extended.Repeats: For each contractor past their end date · 3 contractors
- The manager hearsThe manager gets a message in Microsoft Teams naming the contractor and the end date, so an extension that never reached Deel gets caught the same morning.Repeats: For each contractor past their end date · 3 contractors
- The sweep gets listedAfter the last contractor, the Summary card lists who was suspended and anything that failed.
- IT sees itThe list goes to the IT channel in Microsoft Teams, and the run record keeps the time each account was suspended.
Field map
| From | To |
|---|---|
| DeelContract: end date, work email | Microsoft Entra IDUser: suspendOnce the end date has passed |
| DeelContract: manager | Microsoft TeamsMessage to the manager |
Close out a leaver's cards, expenses, and final pay items
When a departure is posted in Microsoft Teams, Stepwork suspends the leaver's cards in Ramp, moves any open expense reports to their manager, and flags what's owed in ADP Workforce Now, then sends payroll the close-out.
- Microsoft Teams
- Ramp
ADP Workforce Now
Swap in your systemsThe steps stay the same. Only the screens change.
Step by step
- The departure is postedHR posts the departure in the offboarding channel in Microsoft Teams with the person and their last day. That message starts the run.
- The cards get suspendedThe recorded flow suspends every card issued to them in Ramp, so nothing new can be charged after they go.
- Open expenses get readStepwork reads any expense reports that haven't been approved or reimbursed yet, and the total the leaver is owed.
- The rule checks for open reportsIf any reports are still open, the run takes the top path. If none are, it goes straight to payroll.
- If reports are openMove the open reports to their manager
- If none are openFlag final pay items in ADP Workforce Now
- Open reports move to the managerOnly when reports are open: the recorded flow moves them to the manager, so they get approved instead of stranded on a closed account.Only on this path: If reports are open
- Final pay items get flaggedBoth paths meet here. Stepwork adds a note in ADP Workforce Now with the last day and any reimbursement owed, for the payroll team to review before the final paycheck.
- Payroll gets the close-outThe close-out goes to payroll in Microsoft Teams: cards suspended, reports moved, and what was flagged for final pay.
Field map
| From | To |
|---|---|
| Microsoft TeamsDeparture: work email | RampCards: suspend |
| Microsoft TeamsDeparture: manager | RampOpen reports: new approverOnly when reports are open |
| RampOpen reports: amount owed | ADP Workforce NowFinal pay noteFor the payroll team to review |
Hand a leaver's files to their manager before the accounts close
An offboarding ticket names the leaver and their manager. Stepwork moves the leaver's files in Microsoft 365, works through each app where they own files, meetings, or records, and closes the ticket with the list.
- Freshservice
Microsoft 365Dropbox
Figma
Swap in your systemsThe steps stay the same. Only the screens change.
Step by step
- The ticket comes inSomeone opens an offboarding ticket in Freshservice with the leaver and the person who should get their work, usually the manager.
- Their files move firstThe recorded flow hands the leaver's files to the manager in the Microsoft 365 admin console, the way an admin would, and waits until the transfer finishes.
- Each app hands overInside the solid frame, Stepwork works through the apps on your list, like Dropbox files, Figma files, and Zoom recordings, and transfers each one to the manager.Repeats: For each app with work to hand over · 5 apps
- The list gets writtenAfter the last app, the Summary card lists what moved, where, and to whom, and anything that needs a person.
- The ticket closes with the listStepwork adds the list to the ticket and resolves it in Freshservice. From there, the accounts can be closed without losing anyone's work.
Field map
| From | To |
|---|---|
| FreshserviceTicket: leaver and manager | Microsoft 365Data transfer: from and to |
| FreshserviceTicket: manager | DropboxContent transfer: recipientOnce per app on the list |
| FigmaFiles transferred | FreshserviceTicket: note and status |
Flows
The offboarding flows these procedures are built from
Each flow is one recorded job in one app. Procedures run them back to back for each leaver, and any of them can also run on its own from a request.
- Microsoft Entra ID
Disable user account
Signs into the Entra admin center, locates the user, and blocks sign-in, disabling the account across Microsoft services. - Okta
Deactivate user account
Signs into the Okta admin console, locates the user by email, deactivates the account, and confirms the status change ended all SSO sessions. - Google Workspace
Suspend user account
Signs into the Google Admin console, locates the user, and suspends the account, blocking sign-in while preserving data. - Microsoft 365
Remove license and convert mailbox to shared
Converts a departed user's mailbox to a shared mailbox and removes their paid license in the admin center. 
JamfLock and wipe device on offboard
Sends a remote lock and wipe command to a departing employee's Mac and confirms command status.- Slack
Deactivate member account
Signs into Slack admin, locates the member, and deactivates their account, removing workspace access. 
GitHubRemove member from organization
Signs into GitHub org settings, locates the member, and removes them, revoking repo access and freeing the seat.
AWSDeactivate IAM user
Disables console access and deactivates credentials for an IAM user in the AWS console.
SalesforceReassign records from departing user
Transfers accounts, open opportunities, and cases owned by a departing user to a named colleague.
1PasswordSuspend user
Signs into the 1Password admin console, locates the member, and suspends their account, blocking vault access.- Google Workspace
Transfer Drive ownership to manager
Uses the Google Admin data transfer tool to move a departing user's Drive files to their manager and confirms completion. - Dropbox
Transfer content on offboard
Transfers a departing member's files to their manager as part of account removal. - Figma
Transfer file ownership on offboard
Moves a departing member's draft files into team projects before their account is removed. - Zoom
Transfer meetings and recordings on offboard
Transfers a departing user's upcoming meetings, webinars, and cloud recordings to a designated colleague before deactivation. 
JiraReassign open issues from departing user
Finds all issues assigned to a departing user and reassigns them to their manager or a named teammate.- Ramp
Suspend cards for departed employee
Suspends all physical and virtual cards for the departing employee and notes open subscriptions tied to them. - ADP Workforce Now
Flag final pay items for a leaver
Opens the employee in payroll and adds their last day and any reimbursement owed as a note on final pay, for the payroll team to review. - Internal tool
Close a leaver's account in an internal tool
Signs in to the internal admin page, finds the leaver by email, disables the account, and saves the user list afterwards as a timestamped screenshot.
More procedures
More offboarding procedures
Ready-made procedures in the Marketplace for same-day exits, devices, and handovers.
- 1 moreRippling · Okta · Google Workspace + 1 more
Same-day termination deprovision sweep
Extracts this week's terminations from Rippling each morning, cross-checks each against Okta status, and for any still active runs the Okta deactivation, Google Workspace suspension, and Slack deactivation, flagging exceptions to IT. - Freshservice · Jamf
Device recovery and reassignment on departure
Pulls the departing employee's asset assignments from Freshservice, locks the devices in Jamf, and once returned wipes and reassigns them to the next user, updating the asset record trail. 1 more
GitHub · Jira · Linear + 1 moreDeparting engineer code handover
For a departing engineer, downgrades or removes GitHub access and Copilot seat, removes CircleCI membership, and reassigns their open Jira and Linear issues to the team lead, posting the handover summary.
1 more
Salesforce · Outreach · Salesloft + 1 moreDeparting rep territory transition
For a departing rep, reassigns their Salesforce accounts and opportunities per territory rules, transfers active Outreach sequences and Salesloft cadences to the covering rep, and posts the transition manifest to the sales manager.
Why Stepwork
The same offboarding for every leaver, on the record
Stepwork is a deterministic agent platform: it runs the steps you recorded in each admin console, in the same order, for every leaver. Every run records which accounts were closed, what moved to whom, who or what started it, and when each step ran, so when someone asks when a leaver lost access, the answer is in the run record. Credentials stay in your vault, and nothing changes in an app unless a procedure is built to change it.
Deterministic agentsProceduresCredentials
Book a DemoFAQ
Common questions
The math
What manual offboarding costs IT and People Ops
Example volumes for a company of about 400 people with two departures a week, each with 12 apps outside single sign-on. Swap in yours.
Illustrative estimate, not a quote. These are example volumes and typical hand times, not a customer's results. Your numbers will differ, and we can work them out with you.
| The manual task | Times a week | Minutes each | Hours a week |
|---|---|---|---|
| Deactivate the account and end their sessions | 2 | 10 | 0.3 |
| Remove them from an app outside single sign-on | 24 | 6 | 2.4 |
| Hand files and records over to the manager | 2 | 35 | 1.2 |
| Lock the laptop, suspend cards, and flag final pay | 2 | 20 | 0.7 |
| Check contractor end dates against live accounts | 1 | 30 | 0.5 |
- Hours a week
- 5.1
- Hours a year
- 253
- Of one full-time person
- 13%
Example volumes, not a customer's numbers. Minutes are the typical time to do each task by hand. Hours a year assume 50 working weeks.