Preparing for ISO 27001, a SaaS company found departed employees' accounts still active weeks after exit. We built a sequenced revocation triggered by the HR system — every account across 22 tools goes dark in 15 minutes, with a timestamped audit log as proof.
Typical results
22
Tools revoked automatically
0
Stale accounts in last audit
100%
Departures fully logged
Figures reflect typical results for this kind of automation.
The challenge
Offboarding ran on a checklist nobody owned. IT revoked SSO when the ticket arrived, but code repositories, cloud consoles and third-party tools lagged for days — a pre-audit review found 47 accounts belonging to people who had already left. With ISO 27001 certification approaching, the forgotten-account gap was both a security risk and a guaranteed audit finding.
Before and after
IT time per departure
−94%Stale accounts found in audit
−100%Departures with complete audit log
The automation
We made the termination date in the HR system the single trigger for a sequenced revocation: SSO first, then code repositories, cloud consoles and 22 third-party tools, each step confirmed before the next runs. Owned documents, repositories and scheduled jobs are reassigned to the manager so nothing breaks, any tool that fails to confirm pages IT immediately, and every action is written to a timestamped audit log filed per departure.
How it works
- 01
HR date is the trigger
The termination date in the HR system starts the sequence automatically — same-day exits included.
- 02
Revocation runs in order
SSO first, then code repositories, cloud consoles and 22 third-party tools — each revocation confirmed before the next step runs.
- 03
Resources reassigned, not lost
Owned documents, repositories and scheduled jobs transfer to the manager, so nothing breaks when the account closes.
- 04
Proof generated automatically
Every action lands in a timestamped audit log filed per departure — exactly the evidence ISO 27001 auditors ask for.
- 05
Exceptions page a human
Any system that fails to confirm revocation alerts IT immediately instead of failing silently.
Starts from
- HR termination date
- Access inventory
Delivers
- Access revoked across the stack
- Owned resources reassigned
- Timestamped audit log
The impact
Full revocation now completes in 15 minutes instead of dragging on for days, and IT effort per departure fell from four hours to a 15-minute log review. Quarterly access reviews typically find zero stale accounts instead of dozens, and the timestamped logs give an ISO 27001 assessor the access-control evidence they usually ask for.
Questions about this automation
Why does the revocation run in a fixed order?
SSO is closed first, so the person cannot sign in anywhere new, and then code repositories, cloud consoles and third-party tools follow. Each step must confirm before the next runs. The order also leaves time to transfer owned documents, repositories and scheduled jobs to the manager before an account is removed.
What if one of the tools fails to revoke access?
Any system that does not confirm the revocation alerts IT right away instead of failing silently. The alert names the tool, the account and the error, and the audit log keeps that step open until someone resolves it. That way no departure is marked complete while an account is still active.
Will the audit log satisfy an ISO 27001 assessor?
The log records every action with a timestamp, the system involved and its confirmation, filed per departure. That is the kind of evidence an assessor usually asks for when reviewing access control. The automation produces the record; the company's own policies and the assessor's review still decide the audit outcome.