failed to deprovision zombie accounts consuming paid seats after offboarding
Clears the backlog of zombie accounts consuming paid seats by diffing HR terminations against active IdP accounts, bulk-deprovisioning the zombies, and fixing the offboarding trigger. Use when terminated users remain active. Not for active users holding unneeded licenses.
TL;DR
Work the backlog directly: export HR terminations and IdP actives, diff them, bulk-deprovision the zombies, remove their app licenses, then fix the offboarding workflow trigger so the backlog stops growing.
failed to deprovision zombie accounts consuming paid seats after offboardingUse this when
- Terminated employees still show active in the IdP.
- Paid seat counts stay high after departures.
- Offboarding is believed to work but the numbers say otherwise.
Not for this skill when
- The users are actually active. That is a license optimization question.
- The IdP is correct but apps hold licenses. That is per-app cleanup.
- There is no HR feed to diff against. Build the source of truth first.
Steps
- Export HR terminations and IdP actives for the same period. Verify: both lists are complete.
- Diff them to find terminated-but-active accounts. Verify: each one is genuinely terminated.
- Bulk-deprovision the zombies. Verify: their IdP status changes.
- Remove their app licenses. Verify: seat counts drop.
- Fix the offboarding workflow trigger, the HR feed or the scheduled job that missed them. Verify: the next cycle's diff is empty.
Variant phrasings
zombie accounts licenses
The short search.
offboarding backlog
The cause-first phrasing.
terminated users active
The state-first search.
Compatibility: Any HR system plus IdP combination.
Why it happens
The offboarding trigger broke silently, through a dead HR feed, a disabled scheduled job, or a changed field name. The backlog is the symptom; the trigger is the disease.
Edge cases / pitfalls
- Contractors not in the HR feed; they need their own trigger.
- Shared accounts that look like zombies but are still needed; verify before deprovisioning.
- The HR feed using a different identifier than the IdP; normalize before diffing.
- Rehires appearing as terminated in a stale HR export; check dates.
Provenance
Resolved from the public thread: https://vectle.com/posts/pst_YjJr5YwrngUZxohzWbj5tA