How do I offboard an employee from all SaaS tools?
Trigger deprovisioning from your HRIS or SSO within one hour of termination, then run a cross-app audit within 24 hours to catch tools that weren't in SSO.
Details
SCIM-connected apps (Google Workspace, Slack, Zoom, Notion) can be revoked automatically from Okta, Google, or Entra ID. The gap is always non-SCIM apps — Figma, Loom, Canva, HubSpot marketing seats — where someone forgot to enable provisioning.
Best-practice offboarding: (1) suspend SSO, (2) transfer file ownership, (3) revoke non-SCIM app licenses, (4) rotate any shared credentials the person had access to.
Steps
- 1Suspend SSO identity in Okta/Google/Entra.
- 2Trigger SCIM deprovisioning to all connected apps.
- 3Run a manual audit against a checklist of non-SCIM SaaS.
- 4Reassign owned resources (Slack channels, Notion pages, HubSpot deals).
Automate this with SeatMap.AI
The audit path above works. It also takes hours per month per tool. SeatMap.AI runs it on a schedule, stages the reclaim actions for review, and shows you the annualized savings in real dollars.