How to Automate SaaS Offboarding When an Employee Leaves

The average organisation takes 3.5 days to fully revoke access for a departed employee. In that window, ex-employees retain access to email, file storage, CRM records, and often financial systems. The risk is real: a significant proportion of data breaches involve former employees accessing systems they should no longer be able to reach.

Why Manual Offboarding Fails

Manual offboarding checklists fail for two reasons. First, they depend on someone remembering to run them — and HR doesn't always notify IT on the day of departure. Second, they only cover the tools IT knows about. Shadow IT apps, personal accounts used for work, and recently adopted tools frequently fall through the gaps.

Building an Automated Process

The starting point is an integration between your HRIS and your licence management platform. When a departure is recorded in your HR system, it should automatically trigger an offboarding workflow in Liceo — surfacing every tool assigned to that employee and creating a task for each revocation.

For tools connected to SSO, revocation can be near-instant — disabling the SSO account effectively locks the employee out of every connected app simultaneously. For tools outside SSO, Liceo creates manual revocation tasks with due dates so nothing gets missed.

Handling Edge Cases

Two situations require extra care: shared accounts (where one login is used by multiple people) and tools owned personally by the employee. Document both in your asset inventory so they surface during offboarding review rather than being discovered weeks later.

Measuring Offboarding Effectiveness

Two metrics define a well-functioning offboarding programme: mean time to revocation (the average time from departure confirmation to all access being closed) and completeness rate (the percentage of known tool accesses that are successfully revoked, versus those that are missed and discovered later). Track both quarterly and set improvement targets. An organisation starting with a 3.5-day mean time to revocation should be aiming for same-day revocation within twelve months of implementing an automated process.

Audit your offboarding process quarterly by selecting a random sample of departures from the previous quarter and checking whether access was fully revoked within your policy window. Even with automation in place, exceptions occur — the tool added to the stack two weeks before someone left, the shared account that wasn't in the inventory, the personal device with saved credentials. Regular auditing catches these gaps before they accumulate into systemic risk.

The Security Case for Speed

Every hour of residual access after an employee departs represents real risk. The majority of insider threat incidents involving former employees occur within the first week after departure, while credentials are still fresh and the individual may still have motivation to act. Speed of revocation is not just an administrative efficiency target — it is a security control with a direct relationship to the probability and severity of a post-departure incident.

For employees in sensitive roles — those with access to financial systems, customer data, source code, or administrator credentials — target revocation within two hours of departure confirmation, not 24. Build an escalation path for high-sensitivity departures: a dedicated Slack channel or ticket queue that bypasses standard IT ticketing SLAs and goes directly to a named on-call responsible party.

Connecting Offboarding to Cost Recovery

Offboarding is also a cost recovery event. Every licence revoked during offboarding is a seat that can be removed from the next renewal, or reallocated to a new hire without purchasing additional seats. Track the licence inventory impact of each offboarding event — the total monthly seat cost of licences revoked — and aggregate this into a quarterly "savings from offboarding" figure. For organisations with regular turnover, this number is often surprisingly large, and it makes a compelling case for investing in faster, more automated offboarding processes.