Employee Account Termination
Automated employee account termination with approval, identity provider deactivation, and session termination.
The Employee Account Termination agent automates employee offboarding with approval workflow, identity provider account deactivation, and session termination.
What it does
Triggered when employee termination is initiated by authorized personnel
Creates a high-priority ticket and routes it for manager approval - no accounts are touched until the request is explicitly authorized
Sends approval request to one or more approvers and waits for response
On approval: deactivates user account in configured identity providers
Automatically discovers employee's IdP integrations and deactivates across all configured providers
Terminates all active sessions for the user across configured identity providers
Updates the ticket with the outcome
Can be triggered automatically by the Offboarding Agent as a seamless next step, with no manual hand-off required
Triggers
Event - Runs when employee termination initiated by authorized personnel.
The agent can also be triggered automatically by the Offboarding Agent. When an offboarding workflow completes the necessary steps, it initiates the Account Termination Agent directly - running in a system-driven context that uses the departing employee's identity for all functional operations.
Approval
Requires approval by default. Configure approvers (e.g., direct manager), approval logic (require one or all), and timeout settings.
Configuration
Set approvers
Approval logic - Require approval from one of the approvers, or require all approvers to approve
Approvers - Default: Direct manager
Execution settings
Approval request timeout - Days before approval request times out (e.g., 2 days)
Notifications
Toggle notifications for approval status updates.
Termination Targets
Select where the employee's access will be revoked (at least one required):
Okta
Disable account - Deactivate the user's Okta account
Terminate sessions - End all active Okta sessions
Microsoft Entra ID
Disable sign-in - Prevent the user from signing in to Microsoft Entra
Revoke sign-in sessions - End all active Microsoft Entra sessions
JumpCloud
Suspend account - Suspend the user's JumpCloud account
Sign out all sessions - End all active JumpCloud sessions
The agent supports Okta, Microsoft Entra ID, and JumpCloud identity providers. It automatically discovers the employee's IdP integrations and performs deactivation and session termination across all configured providers.
Finding and offboarding terminated employees
By default, employee searches return only active employees. If an employee has already been deactivated in your systems and you need to complete their offboarding, you can explicitly request that the agent include terminated users in its search.
To search for a terminated employee, include a clear instruction in your prompt, for example:
"Offboard user xyz@example.com, look for terminated users as well."
The agent will then locate the user and apply the appropriate offboarding actions. This ensures you can complete offboarding workflows even after an employee has already been deactivated - without the agent incorrectly reporting that the user does not exist.
End-to-end automation
The Account Termination Agent handles the full offboarding sequence without manual intervention:
A termination request is submitted and a high-priority ticket is created
The request is routed to the configured approver(s) for explicit authorization
Once approved, the agent automatically executes:
Account deactivation across all connected identity providers
Session termination for all active sessions belonging to the departing employee
Ticket updates reflecting the outcome at each stage
When triggered automatically by the Offboarding Agent, the process runs end-to-end with no manual hand-off, reducing intervention and speeding up offboarding completion.
Last updated
Was this helpful?