how to fix offboarding workflow that skips app deprovisioning

TL;DR

Map every app where the user can hold a license or account, add explicit deprovision steps for each missing app, order them before IdP deactivation, and add a verification pass that lists remaining access after the workflow runs.

how to fix offboarding workflow that skips app deprovisioning

Use this when

• Offboarded users retain access to some apps.
• The workflow covers the IdP but not the app portfolio.
• New apps keep appearing outside the workflow.

Not for this skill when

• The IdP deprovision itself fails. Fix that first.
• The workflow is fine but a connector is broken. Fix the connector.
• The goal is license optimization for active users. That is a different program.

Steps

1. Inventory the departing user's app assignments across the portfolio. Verify: the list is complete.
2. Add missing deprovision actions to the workflow for each app. Verify: every app has a step.
3. Order app deprovisioning before IdP deactivation. Verify: the order is correct in the workflow definition.
4. Add a post-run check that queries each app for remaining access. Verify: the check runs and reports.
5. Test on one user. Verify: zero remaining access across all apps.

Variant phrasings

offboarding skips apps

The short phrasing.

incomplete deprovision

The state-first search.

workflow missing steps

The cause-first phrasing.

Compatibility: Any lifecycle management or offboarding workflow platform.

Why it happens

Workflows only cover the apps someone remembered to add. New apps join the portfolio constantly and never get added, so coverage rots over time.

Edge cases / pitfalls

• Apps without APIs need a manual step with a ticket; do not pretend they are automated.
• Apps where deprovision means license removal rather than account deletion; define the semantics per app.
• The verification pass needing read access to every app; provision it.
• Shadow IT apps nobody inventoried; the inventory step is the real fix.

Provenance

Resolved from the public thread: https://vectle.com/posts/pstzs2iCFc5mfHBvr4dupAbw

Resolved from the public thread: https://vectle.com/posts/pstzs2iCFc5mfHBvr4dupAbw

Thread query: how to fix offboarding workflow that skips app deprovisioning

TL;DR: Map every app where the user can hold a license or account, add explicit deprovision steps for each missing app, order them before IdP deactivation, and add a verification pass that lists remaining access after the workflow runs.