title: Leaver Templates - Offboarding Automation category: Lifecycle Management tags: leaver, offboarding, termination, automation, templates priority: Normal

Leaver Templates - Offboarding Automation

Leaver templates automate the deprovisioning workflow that executes when an employee, contractor, or vendor departs the organization. Timely offboarding is one of the most critical security operations in identity management -- every hour an account remains active after departure represents a potential unauthorized access window.

The Cost of Manual Offboarding

Industry research consistently shows that manual offboarding processes leave accounts active for days or weeks after departure:

Creating a Leaver Template

Navigate to Administration > Lifecycle Management (/admin/lifecycle) and select New Template. Choose Leaver as the template type.

Step 1: Template Details

Step 2: Trigger Configuration

HR Feed trigger: When the HR system populates a TerminationDate field and that date is today or in the past, the Leaver template fires automatically.

Scheduled trigger: A nightly job evaluates all identities for termination criteria (e.g., contract end date passed, termination date reached) and processes any matches.

Step 3: Target Criteria

Step 4: Define Actions

DisableAccount

Immediately disables the Active Directory account to prevent authentication:

Tip: Always disable the account as the first action. This ensures access is revoked immediately, even if subsequent actions fail.

RemoveGroups

Removes the identity from all group memberships:

Important: The removed group list is preserved in the lifecycle event record for audit purposes. This allows you to demonstrate exactly what access was revoked and when.

RevokeAccess

Removes all application-level and resource access entitlements:

ForwardEmail

Configures email forwarding to ensure business continuity:

BackupData

Archives the departing employee's data before account removal:

MoveOU

Moves the disabled account to a designated OU for departed employees:

SendEmail

Notifies relevant parties that offboarding is complete:

Offboarding Timing

Immediate Offboarding

All actions execute as soon as the template is triggered. Used for:

• Involuntary terminations
• Security incidents
• Emergency departures

Configuration: Set the template trigger to Manual and execute it immediately when HR or management initiates the departure.

Scheduled Offboarding

Actions execute on a specific future date (typically the employee's last day). Used for:

• Planned resignations
• Retirements
• Contract expirations

Configuration: The HR Feed provides a TerminationDate. IdentityCenter creates a pending lifecycle event that executes on that date.

Grace Period Configuration

Some organizations require a grace period before full deprovisioning:

Emergency Termination

For situations requiring immediate and complete access revocation:

1. Navigate to the identity in IdentityCenter
2. Select Emergency Offboard from the actions menu
3. Confirm the action

The emergency offboard process:

• Immediately disables the account and randomizes the password
• Removes all group memberships
• Revokes all application access and OAuth tokens
• Forces termination of active sessions
• Sends emergency notification to security team and management
• Logs the event with the administrator who initiated it

Tip: Configure a dedicated "Emergency Termination" Leaver template with the highest priority and all security-critical actions enabled.

Example: Standard Leaver Template

Template: Standard Employee Offboarding
Trigger:  HR Feed (termination date reached)
Criteria: EmployeeType = "Full-Time" or "Part-Time"

Actions:
  1. DisableAccount
     - Reset password: Yes
     - Clear sessions: Yes

  2. RemoveGroups
     - Scope: All groups
     - Log memberships: Yes

  3. RevokeAccess
     - Scope: All connected applications
     - Revoke OAuth tokens: Yes

  4. ForwardEmail
     - Forward to: Manager
     - Duration: 30 days
     - Auto-reply: Enabled

  5. BackupData
     - Scope: Mailbox, home directory
     - Retention: 1 year
     - Notify: Manager, HR

  6. MoveOU
     - Target: OU=Disabled,OU=Users,DC=corp,DC=local

  7. SendEmail
     - Template: "Offboarding Complete"
     - To: Manager, HR, IT Helpdesk
     - Include summary: Yes

Integration with HR Systems

Leaver templates are most effective when driven by HR data:

1. HR system records a termination date for the employee
2. HR Import brings the termination date into IdentityCenter (see CSV Import or REST API Import)
3. Lifecycle engine evaluates the date against Leaver template criteria
4. Template executes on the termination date, performing all configured actions
5. Audit record is created for compliance reporting

Best Practices

1. Disable first, clean up second -- always make DisableAccount the first action
2. Randomize the password upon disable to prevent reactivation with known credentials
3. Log all removed group memberships for audit and potential rollback
4. Configure email forwarding to maintain business continuity
5. Back up data before removal -- some data cannot be recovered after account deletion
6. Use grace periods for planned departures to allow for data transfer
7. Test emergency offboarding periodically to ensure it works under pressure
8. Never delete accounts immediately -- disable and archive first, then delete after retention period

Next Steps

• Lifecycle Events -- Monitor offboarding execution and audit trail
• Joiner Templates -- Onboarding automation
• Mover Templates -- Transfer automation
• HR Integration Overview -- Connect HR for termination date triggers
• Policies Overview -- Define retention and offboarding policies