Loading_
Loading_
Same-hour access revocation with evidence-grade audit — the control auditors ask about first.
Measured outcomes
100%
Access revoked same hour
0
Orphaned accounts
−100%
Manual offboarding checklists
Signed
Evidence pack per departure
Offboarding was the mirror image of onboarding, and worse: departures were communicated late, revocation was partial, and nobody could prove when access actually ended.
Termination events now trigger immediate session revocation, staged data handover and a signed evidence pack that satisfies audit without anyone assembling screenshots.
Headline result
0< s
to full revocation
Tags
Five capabilities that define the system. Each one exists because something specific was broken.
Refresh tokens revoked and active sessions terminated across Entra ID, VPN and SaaS.
Mailbox delegation, OneDrive transfer and shared ownership reassignment on a defined schedule.
Device return chased automatically with escalation to the manager and payroll.
Seats return to the pool once the retention window closes.
A signed, timestamped record of every revocation step for audit.
Two-phase execution: an immediate revocation burst, then a scheduled data-handling phase that respects retention policy.
4 components
Runs in parallel with a hard 60-second budget.
4 components
Each step gated on the configured retention window.
3 components
The pack is generated at completion and immutable thereafter.
No mystery components. Everything below is either open source or a platform you already own.
Interactive mock-ups of the shipped interface. The live environment is available during a demo session.
In-flight offboardings by phase
The running environment is available during a booked session — including a sandbox tenant you can drive yourself.
The real sequence, in order. Steps with a command are copy-pasteable.
Offboarding workflows deploy into the same Temporal namespace.
$helm upgrade onboarding aiinfraengine/onboarding --set offboarding.enabled=trueAdd User.RevokeSessions.All and directory write permissions to the app registration.
Set per-jurisdiction retention windows for mailbox and file data.
Run a full cycle against a synthetic user and review the evidence pack.
Published rather than hidden behind a call. Volume and multi-year terms move these numbers.
Platform
$32per departure processed
Implementation
from $22kone-time
Need this scoped against your estate? We will size it properly, in writing, within a week.
Request a quoteWe will walk you through the architecture, the trade-offs we made, and what would change for your environment.