Skip to main content

Governance intelligence for access, cloud, and SaaS. Now in early access

Nuxari
PlaybookOffboardingmedium riskApproval required

Contractor Offboarding

Orchestrate complete contractor access removal across identity, SaaS, and cloud systems at contract end, with configurable approval, removal validation, and a contractor-specific evidence package.

IT operations teamsSecurity teams managing third-party accessVendor and contractor managersMSPs handling contractor lifecycle for clients
Use template

Requires a Nuxari account. Installs as Draft — no changes until you enable it.

Back to templates
~20 min setup
Required
Entra ID

What this template does

This playbook coordinates the full contractor offboarding workflow from access discovery through removal and evidence. It collects the contractor's access footprint across identity, SaaS, and cloud systems, presents it for review, routes the removal plan through an approval gate, and executes revocations at contract end. Each removal is validated and recorded in a contractor-specific evidence package.

When to use it

Use this template at the end of a contractor or consultant engagement when access must be removed completely and promptly. It is especially valuable for organizations with frequent project-based contractors whose access tends to linger after engagements close.

How it works

01

Access discovery

Nuxari collects the contractor's full access across identity, SaaS, and cloud systems and produces a pre-offboarding inventory.

02

Removal plan and approval

A removal plan is generated and routed to the configured approver, who reviews scope and confirms before any access is touched.

03

Scheduled or immediate removal

At contract end, Nuxari executes revocations across each system in the approved order, attempting and logging each action.

04

Validation and evidence

Each removal is validated and a contractor-specific evidence package is assembled with logs, approvals, and a final access snapshot.

What gets created in your tenant

Playbook

Contractor Offboarding Playbook

The core playbook driving contractor access removal from discovery through evidence.

Approval Workflow

Contractor Removal Approval

An approval gate requiring sign-off before any contractor access is revoked.

Evidence Package Template

Contractor Offboarding Evidence

A structured evidence record capturing removal logs, approvals, and completion state.

What evidence it produces

  • Contractor access inventory at contract end
  • Access removal log per system
  • Approval record with timestamp and approver identity
  • Contractor offboarding completion certificate
  • Final access state snapshot

Safety and approval model

Templates install as Draft / Disabled by default. No actions run until you explicitly enable the template after reviewing the configuration.

This template requires an approval decision before enabling. No execution occurs without a recorded approver sign-off.

This template installs in Draft state and performs access removal — a destructive action. No access is revoked until you connect the required connectors, review the configuration, and explicitly enable the playbook. The approval gate is required and cannot be bypassed. Every revocation is individually validated and logged.

Customization options

  • Approval chain configuration
  • Connector scope (which systems are included)
  • Execution timing (immediate or scheduled to contract end)
  • Notification recipients for plan and completion
  • Grace period after approval before execution
  • Optional notification to the contractor's sponsor

Related templates

Offboarding

Scheduled Employee Offboarding

Plan, approve, and execute complete employee offboarding in advance. Revokes access across identity, SaaS, and cloud at the scheduled time and generates a full evidence package.

View template
Offboarding

Residual Access Sweep

Scan all connected systems for access belonging to offboarded users, generate findings for residual access, and create remediation tasks for each system with remaining access.

View template
Evidence & Compliance

Offboarding Evidence Package

Generate a comprehensive evidence package for a completed offboarding — access revocation logs, approvals, execution timestamps, final access snapshots, license releases, and device deregistration.

View template

Use this template

Install in your Nuxari tenant and run the full approval and evidence workflow from day one.

Use template
Get started

Build the operating layerfor governance work.

See how Nuxari Ops reduces manual IT work, eliminates access drift, and generates audit evidence automatically, across your entire enterprise.

Explore the platform