Skip to main content

Governance intelligence for access, cloud, and SaaS. Now in early access

Nuxari
PlaybookOffboardinglow riskApproval required

Scheduled Employee Offboarding

Plan, approve, and execute complete employee offboarding in advance. Revokes access across identity, SaaS, and cloud at the scheduled time and generates a full evidence package.

IT operations teamsHR and IT coordinatorsSecurity teams managing contractor offboardingOrganizations with planned departures
Use template

Requires a Nuxari account. Installs as Draft — no changes until you enable it.

Back to templates
~20 min setup
Required
Entra IDMicrosoft 365

What this template does

This playbook coordinates the full employee offboarding workflow from scheduling through execution and evidence generation. It collects the departing employee's current access footprint across connected systems, presents it for review, routes the offboarding plan through an approval gate, and executes access revocations on the scheduled date. Every action is logged with a tamper-evident record.

When to use it

Use this template when you have a planned departure — a resignation, contract end-of-term, or restructuring — and want to ensure access is removed completely on a defined schedule without manual coordination across multiple system administrators. It is especially valuable for organizations that have experienced residual access risk after departures.

How it works

01

Discovery scan

Nuxari collects the employee's current access across all connected systems — Entra ID groups, M365 licenses, SaaS roles, cloud permissions — and produces a pre-offboarding access inventory.

02

Offboarding plan generation

The system generates a structured offboarding plan listing every access item to be revoked, grouped by system, with the target execution date.

03

Approval routing

The plan is routed to the configured approver chain. Approvers can review the full access inventory, adjust the scope, and confirm or reject. No execution occurs until approval is complete.

04

Scheduled execution

At the scheduled date and time, Nuxari executes revocations in the approved order across each system. Each revocation is attempted, validated, and logged.

05

Evidence package generation

On completion, a full evidence package is assembled: revocation logs per system, approval records, execution timestamps, and a final access state snapshot confirming access was removed.

What gets created in your tenant

Playbook

Scheduled Offboarding Playbook

The core playbook definition that drives the offboarding lifecycle, from discovery through evidence generation.

Approval Workflow

Offboarding Approval Gate

A configurable approval chain requiring sign-off before any access is revoked.

Evidence Package Template

Offboarding Evidence Record

A structured evidence template capturing revocation logs, approval decisions, and completion state.

Scheduled Job

Offboarding Execution Job

A time-triggered job that executes the approved offboarding plan at the scheduled date and time.

What evidence it produces

  • Access revocation log per system
  • Approval record with timestamp and approver identity
  • Offboarding completion certificate
  • License release confirmation
  • Final access state snapshot

Safety and approval model

Templates install as Draft / Disabled by default. No actions run until you explicitly enable the template after reviewing the configuration.

This template requires an approval decision before enabling. No execution occurs without a recorded approver sign-off.

This template installs in Draft state. No access is revoked and no jobs are scheduled until you review the configuration, connect the required connectors, and explicitly enable the playbook. The approval gate is required and cannot be bypassed — the execution job will not run without a recorded approval decision. All revocation actions are individually logged and can be reviewed in the audit log.

Customization options

  • Configurable approval chain (single approver, sequential, any-of)
  • Execution time window (specific time, business hours only)
  • Connector scope (select which systems are included in revocation)
  • Notification recipients for plan generation and completion
  • Grace period before execution (buffer after approval)
  • Optional user notification to the departing employee

Related templates

Access Governance

Stale SaaS Account Review

Detect user accounts in connected SaaS applications that have had no activity above a configurable threshold and route deactivation or removal through an approval-gated workflow.

View template
Access Governance

Azure Privileged Access Review

Continuously evaluate privileged role assignments in Azure and Entra ID, surface over-provisioned accounts, and route remediation through approval-gated workflows with full evidence.

View template
Evidence & Compliance

Quarterly Access Recertification

Run a structured quarterly access review across connected systems. Collect manager attestations, route exceptions to approval, and produce a complete evidence package ready for auditors.

View template

Use this template

Install in your Nuxari tenant and run the full approval and evidence workflow from day one.

Use template
Get started

Build the operating layerfor governance work.

See how Nuxari Ops reduces manual IT work, eliminates access drift, and generates audit evidence automatically, across your entire enterprise.

Explore the platform