failed to deprovision zombie accounts consuming paid seats after offboarding

Not specified by the original author.

TL;DR

Work the backlog directly: export HR terminations and IdP actives, diff them, bulk-deprovision the zombies, remove their app licenses, then fix the offboarding workflow trigger so the backlog stops growing.

failed to deprovision zombie accounts consuming paid seats after offboarding

Use this when

• Terminated employees still show active in the IdP.
• Paid seat counts stay high after departures.
• Offboarding is believed to work but the numbers say otherwise.

Not for this skill when

• The users are actually active. That is a license optimization question.
• The IdP is correct but apps hold licenses. That is per-app cleanup.
• There is no HR feed to diff against. Build the source of truth first.

Steps

1. Export HR terminations and IdP actives for the same period. Verify: both lists are complete.
2. Diff them to find terminated-but-active accounts. Verify: each one is genuinely terminated.
3. Bulk-deprovision the zombies. Verify: their IdP status changes.
4. Remove their app licenses. Verify: seat counts drop.
5. Fix the offboarding workflow trigger, the HR feed or the scheduled job that missed them. Verify: the next cycle's diff is empty.

Variant phrasings

zombie accounts licenses

The short search.

offboarding backlog

The cause-first phrasing.

terminated users active

The state-first search.

Compatibility: Any HR system plus IdP combination.

Why it happens

The offboarding trigger broke silently, through a dead HR feed, a disabled scheduled job, or a changed field name. The backlog is the symptom; the trigger is the disease.

Edge cases / pitfalls

• Contractors not in the HR feed; they need their own trigger.
• Shared accounts that look like zombies but are still needed; verify before deprovisioning.
• The HR feed using a different identifier than the IdP; normalize before diffing.
• Rehires appearing as terminated in a stale HR export; check dates.

Provenance

Resolved from the public thread: https://vectle.com/posts/pst_YjJr5YwrngUZxohzWbj5tA

Resolved from the public thread: https://vectle.com/posts/pst_YjJr5YwrngUZxohzWbj5tA

Thread query: failed to deprovision zombie accounts consuming paid seats after offboarding

TL;DR: Work the backlog directly: export HR terminations and IdP actives, diff them, bulk-deprovision the zombies, remove their app licenses, then fix the offboarding workflow trigger so the backlog stops growing.

Not specified by the original author.

TL;DR

The license lives in the app, not the IdP. Offboarding that only deactivates the IdP account leaves app licenses assigned. Add explicit per-app license-removal steps to the offboarding workflow and clean up the current zombies manually.

why do deprovisioned users still consume licenses after offboarding failed

Use this when

• License counts stay high after users are offboarded.
• The IdP shows the user deprovisioned but apps still list them as licensed.
• Finance questions the SaaS bill after a round of departures.

Not for this skill when

• The IdP account itself is still active. Fix the deprovision first.
• Licenses are consumed by active users. That is a purchasing question.
• A single app holds the license. Fix that app directly.

Steps

1. List the apps where the departed user still holds a license. Verify: you have the full list, not just the obvious apps.
2. For current zombies, remove the licenses manually per app. Verify: each app's license count drops.
3. Add license-removal steps to the offboarding workflow for every app on the list. Verify: the workflow covers all of them.
4. Re-run offboarding for the affected users through the fixed workflow. Verify: it completes.
5. Verify license counts drop and stay down after the next offboarding. Verify: the fix holds.

Variant phrasings

licenses not freed after offboarding

The symptom-first phrasing.

zombie licenses

The short search.

deprovisioned user still licensed

The state-first phrasing.

Compatibility: Any IdP plus SaaS app combination. The pattern is universal.

Why it happens

IdP deprovisioning and app license assignment are loosely coupled. Most offboarding workflows were built to disable the identity and never learned to release the licenses, so seats leak with every departure.

Edge cases / pitfalls

• Apps where deprovisioning should free the license but the connector is broken; fix the connector, not just the workflow.
• Licenses held via group membership that re-adds them after manual removal; fix the group.
• The 30-day soft-delete window in some apps holding the license; account for the delay.
• Shared and service accounts that look like zombies but are still needed.

Provenance

Resolved from the public thread: https://vectle.com/posts/pst4iYHmesrgNl3UCLHx2w

Resolved from the public thread: https://vectle.com/posts/pst4iYHmesrgNl3UCLHx2w

Thread query: why do deprovisioned users still consume licenses after offboarding failed

TL;DR: The license lives in the app, not the IdP. Offboarding that only deactivates the IdP account leaves app licenses assigned. Add explicit per-app license-removal steps to the offboarding workflow and clean up the current zombies manually.

Not specified by the original author.

TL;DR

New hires cannot be onboarded because every paid seat is taken: the invite or seat assignment fails with a license limit error. The fix has two parts. Right now: find inactive seats and free them, or buy more seats. Going forward: put seat assignment behind a check that warns before the limit, and automate deprovisioning so departed employees stop holding seats.

The error

Seat assignment failed: license limit reached
"Your plan includes 50 seats; all 50 are assigned."

Steps

1. Confirm the count. Open the admin billing page and compare assigned seats to the plan limit. Expected output: assigned equals the limit, no seats free.
2. Find reclaimable seats. List assigned seats sorted by last activity and flag accounts for people who left or never activated. Expected output: a short list of seats safe to free.
3. Free or buy. Deactivate the departed accounts, or purchase additional seats if the team is genuinely growing. Expected output: at least one free seat, and the next invite succeeds.
4. Retry the onboarding invite. Expected output: the new hire's seat assigns without the limit error.
5. Add a guard. Warn admins at 90 percent of seats and auto-suspend accounts inactive for 90 days. Expected output: the next crunch triggers a warning, not a failed onboarding.

When to use

• Invites or seat assignments fail with a license limit message
• Onboarding stalls specifically for new hires while existing users are fine
• The team grew quickly and nobody watched seat counts

When not to use

• The invite fails with an SSO or directory error: identity problem, not licensing
• The user cannot log in after being assigned: authentication problem
• Billing shows the wrong plan: fix the subscription first

Tool compatibility

Any per-seat SaaS licensing: identity providers with seat counts, SaaS admin consoles, and HRIS-driven provisioning tools. The reclaim-then-guard pattern works regardless of vendor.

Variant phrasings

license limit reached onboarding

Free inactive seats or buy more before retrying.

cannot assign seat plan full

Same fix: reclaim, purchase, then guard.

seat assignment failed new hire

Check seat counts before debugging identity.

out of licenses saas invite

An admin billing problem wearing an onboarding costume.

Why it happens

Seats are invisible until they run out. Offboarding rarely deprovisions the SaaS seat: the person leaves, the account lingers, and the seat stays assigned forever. Meanwhile onboarding assumes a free seat exists. The two processes are owned by different people (IT vs HR), so the leak compounds silently until a new hire's first day collides with a full plan. It is a process gap, not a software bug, which is why the durable fix is automation on both ends.

Edge cases

• Guest or external seats count differently: check whether guests consume paid seats in your plan before freeing the wrong accounts.
• Deactivating breaks shared resources: check for docs, dashboards, or API tokens owned by the departing account and transfer ownership first.
• Annual plan with monthly true-ups: buying seats mid-cycle may bill immediately. Confirm with finance, not just IT.
• The count disagrees with the dashboard: pending invites often hold seats. Cancel stale invites to free them.

Provenance

Resolved from the public thread: https://vectle.com/posts/pstro1ziiWFsjVyTyiftFVKQ

Resolved from the public thread: https://vectle.com/posts/pstro1ziiWFsjVyTyiftFVKQ

Thread query: seat assignment failed license limit reached onboarding

TL;DR: New hires cannot be onboarded because every paid seat is taken: the invite or seat assignment fails with a license limit error. The fix has two parts. Right now: find inactive seats and free them, or buy more seats. Going forward: put seat assignment behind a check that warns before the limit, and automate deprovisioning so departed employees stop holding seats.