1 min lesson
Offboarding as one coordinated event
Use "Not as a manual handoff where one half gets forgotten" to say what you would do next.
Step 1 of 3
Offboarding as one coordinated eventdevice + identity, not two tickets
The leaver workflow from the identity domain and the device offboarding here are the same event seen from two angles. When HRIS marks someone terminated, identity deprovisioning and device action should fire together - not as a manual handoff where one half gets forgotten.
Learn more
Advanced table
One trigger, two coordinated tracks
- Trigger
- HRIS marks leaver
- Identity action
- Disable IdP account, kill active sessions, revoke tokens
- Device action
- MDM flags the device for offboarding
- Trigger
- Standard departure
- Identity action
- Deprovision SaaS via SCIMSystem for Cross-domain Identity Management. A standard for automatically creating and removing user accounts when people join or leave. Press Enter for the full definition./API, transfer data ownership
- Device action
- Remote lock; remote wipe on return; release MDM/ABM record on confirmed disposal
- Trigger
- High-risk / hostile exit
- Identity action
- Immediate session kill and credential reset
- Device action
- Immediate remote lock/wipe, don't wait for the hardware to come back
- Trigger
- Hardware recovered
- Identity action
- Confirm no lingering access remains
- Device action
- Verify wipe, re-image or retire, update inventory to returned/retired
| Trigger | Identity action | Device action |
|---|---|---|
| HRIS marks leaver | Disable IdP account, kill active sessions, revoke tokens | MDM flags the device for offboarding |
| Standard departure | Deprovision SaaS via SCIMSystem for Cross-domain Identity Management. A standard for automatically creating and removing user accounts when people join or leave. Press Enter for the full definition./API, transfer data ownership | Remote lock; remote wipe on return; release MDM/ABM record on confirmed disposal |
| High-risk / hostile exit | Immediate session kill and credential reset | Immediate remote lock/wipe, don't wait for the hardware to come back |
| Hardware recovered | Confirm no lingering access remains | Verify wipe, re-image or retire, update inventory to returned/retired |
One trigger, two coordinated tracks - the failure you're guarding against is killing access but leaving the laptop live or wiping the laptop while a forgotten SaaS token still works.