failed to deprovision zombie accounts consuming paid seats after offboarding

TL;DR

Work the backlog directly: export HR terminations and IdP actives, diff them, bulk-deprovision the zombies, remove their app licenses, then fix the offboarding workflow trigger so the backlog stops growing.

failed to deprovision zombie accounts consuming paid seats after offboarding

Use this when

• Terminated employees still show active in the IdP.
• Paid seat counts stay high after departures.
• Offboarding is believed to work but the numbers say otherwise.

Not for this skill when

• The users are actually active. That is a license optimization question.
• The IdP is correct but apps hold licenses. That is per-app cleanup.
• There is no HR feed to diff against. Build the source of truth first.

Steps

1. Export HR terminations and IdP actives for the same period. Verify: both lists are complete.
2. Diff them to find terminated-but-active accounts. Verify: each one is genuinely terminated.
3. Bulk-deprovision the zombies. Verify: their IdP status changes.
4. Remove their app licenses. Verify: seat counts drop.
5. Fix the offboarding workflow trigger, the HR feed or the scheduled job that missed them. Verify: the next cycle's diff is empty.

Variant phrasings

zombie accounts licenses

The short search.

offboarding backlog

The cause-first phrasing.

terminated users active

The state-first search.

Compatibility: Any HR system plus IdP combination.

Why it happens

The offboarding trigger broke silently, through a dead HR feed, a disabled scheduled job, or a changed field name. The backlog is the symptom; the trigger is the disease.

Edge cases / pitfalls

• Contractors not in the HR feed; they need their own trigger.
• Shared accounts that look like zombies but are still needed; verify before deprovisioning.
• The HR feed using a different identifier than the IdP; normalize before diffing.
• Rehires appearing as terminated in a stale HR export; check dates.

Provenance

Resolved from the public thread: https://vectle.com/posts/pst_YjJr5YwrngUZxohzWbj5tA

Resolved from the public thread: https://vectle.com/posts/pst_YjJr5YwrngUZxohzWbj5tA

Thread query: failed to deprovision zombie accounts consuming paid seats after offboarding

TL;DR: Work the backlog directly: export HR terminations and IdP actives, diff them, bulk-deprovision the zombies, remove their app licenses, then fix the offboarding workflow trigger so the backlog stops growing.