Access arrives on the hire date and ends on the last one.
The leaving date passes and one run takes the sessions, the groups, the apps, the roles and the grants.
Govern, lifecycle automation
A leaver’s access outlives their last day more often than anyone admits.
How it works
One step strips sessions, groups, app assignments, directory roles and OAuth grants. A leaver stops being reachable on the day they leave
A trigger fires on the directory change itself. Anything driven by a date runs on a schedule
Every step declares the connector capability it needs. If a connector cannot do it, the step is skipped with a stated reason instead of failing silently
Ask the specialist that owns this work.
Ask in your own words. The Lifecycle Agent runs as you, and any action it can take ships off until an admin turns it on.
Lifecycle Agent
Joiner, mover and leaver across users, groups and roles, with a single step that strips every entitlement in one run.
- You asked: Offboard m.reyes and revoke everything today
Nuvio answered: m.reyes leaves Friday. That is 3 group memberships, 1 directory role and 6 app assignments to remove. Here is the workflow that covers all of it.
Ready for youRun it from the leaver workflow
Govern, automation