The "Automated Employee Offboarding" workflow template streamlines the process of disabling all SailPoint-managed accounts when an employee is terminated. Triggered by a SailPoint identity state change event, this workflow ensures swift and consistent offboarding by verifying termination, retrieving associated accounts, and disabling those not already inactive. It also creates a ServiceNow incident for hardware retrieval and sends a Slack notification to the security team, enhancing security and operational efficiency.
Trigger
Use Cases
Case Management , Identity and Access Management
Workflow Breakdown
Triggered by a SailPoint identity state change event
Check whether the identity's state has changed; exit if no change
Retrieve the full identity record from SailPoint
Check whether the identity has been terminated; exit if not
Retrieve all accounts associated with the terminated identity
For each account, check whether it is already disabled
Create a ServiceNow incident for hardware retrieval and offboarding tracking
Send a Slack notification to the security team summarizing the actions taken
Vendors
Slack, Utils, ServiceNow OAuth, SailPoint