Automating the onboarding process means connecting one trigger from your HR system to a fixed sequence of actions on the device and in your systems. Onboarding covers account creation, software install, licence allocation and access. Offboarding covers access revocation, device wipe, licence reclaim and data handover.<\/p>\n
Offboarding is the half that matters more, and the half most IT teams do worst.<\/p>\n
Onboarding failures are visible. A new joiner cannot log in, so they call the help desk on day one and someone fixes it within the hour.<\/p>\n
Offboarding failures are invisible. Nobody complains when an account stays live after someone leaves. That is exactly why it stays live.<\/p>\n
An orphaned account is a login or system access that still belongs to a former employee after they have left.<\/strong><\/p>\n The scale is well documented. A 2026 identity governance report found 89% of enterprise CISOs now rank orphaned accounts as a top three SaaS security governance issue<\/a>, alongside privilege escalation and shadow IT.<\/p>\n The cause is a process gap, not carelessness. HR records the departure, but that event never reliably triggers access revocation across IT systems<\/a>.<\/p>\n Two things make it worse over time. These accounts often keep elevated permissions, because people accumulate access over the years but rarely lose it. When the identity becomes orphaned, you have a privileged account with no owner<\/a>.<\/p>\n And a former employee does not need to be malicious for this to hurt. A forgotten account is a live door with nobody watching it<\/a>.<\/p>\n Deprovisioning latency, meaning how long access lingers after someone leaves, is increasingly asked about by auditors and cyber insurers<\/a>.<\/p>\n Most IT teams cannot answer it. If yours can, you are ahead of the majority.<\/p>\n Before designing anything, look at the ticket data. A manual onboarding procedure produces a predictable pattern.<\/p>\n Day one:<\/strong> cannot log in, machine not ready, missing software.<\/p>\n Day two and three:<\/strong> how do I connect to the printer, where is the shared drive, how do I set up VPN.<\/p>\n Week two:<\/strong> licence missing for a tool the role needed but nobody listed.<\/p>\n That day-two cluster is the one most helpdesk software reports lump into “general query” and nobody investigates. It is usually the largest group, and it is entirely preventable.<\/p>\n Offboarding produces almost no tickets at all, which is the problem. Silence is not success here.<\/p>\n That third group is why the day-two ticket wave exists. The machine works. The person does not know how to use it, and the help desk absorbs the difference.<\/p>\n For roles with elevated privileges or access to trade secrets and financial systems, revocation should happen within minutes, using session revocation so any device still logged in loses access at once<\/a>.<\/p>\n Accounts created outside single sign on. Employees frequently keep direct accounts that bypass SSO, so those need separate discovery and revocation<\/a>.<\/p>\n Personal devices holding corporate data. Physical access and badges. Shared credentials the person knew.<\/p>\n Your IT asset management records are what make both halves work, and they are usually the weakest link.<\/p>\n Onboarding needs asset management to answer one question: what does this role get? Without a defined bundle per role, someone guesses, and the guess produces a week-two licence ticket.<\/p>\n Offboarding needs it to answer three questions. What was issued to this person, what came back, and what is still assigned.<\/p>\n Most organisations discover their asset records are stale exactly when they need them. A laptop marked as issued to someone who left in March is either lost, sitting in a drawer, or quietly running on someone else’s desk.<\/p>\n Run this check before you automate anything. Compare your IT asset management records against your current staff list. The gap is your real starting point.<\/p>\n Everything above is easy. Making it start reliably is the hard part.<\/p>\n The core of a working process is one shared trigger and a named owner, so the leaver event recorded in HR automatically starts revocation in IT, rather than waiting for a ticket that may never arrive<\/a>.<\/p>\n A ticket-based offboarding procedure fails silently, because a ticket nobody raises produces no alert.<\/p>\n Three trigger patterns, worst to best:<\/p>\n If you build one thing from this post, build the third. HRMS onboarding integration is what turns a checklist into a process.<\/p>\n Take your last ten leavers. For each, find when HR recorded the exit, when the account was disabled, and when the device came back.<\/p>\n The gap between the first two is your current deprovisioning latency. It is usually worse than people expect.<\/p>\n Clean up before you automate. Run a report of accounts with no login in 90 days and cross-check against your staff list.<\/p>\n You will find leavers from years ago. Do this first, or you are automating on top of a mess.<\/p>\n List the applications your teams actually use, not the ones you licensed. Expense reports and network logs both help.<\/p>\n Anything not behind single sign on needs a manual step and a named owner.<\/p>\n You cannot automate onboarding without knowing what a Finance Analyst gets versus a Plant Engineer.<\/p>\n Write these as named bundles: software, licences, group memberships, policies. Ten to fifteen bundles covers most organisations.<\/p>\n The immediate tier runs the moment the trigger fires. Disable account, kill sessions, revoke MFA.<\/p>\n The same-day tier runs after. Licence reclaim, data transfer, device wipe.<\/p>\n Splitting them matters, because the immediate tier must never wait on a human decision.<\/p>\n Machine build and account creation is the easy part. Add what most teams skip: on-screen guidance for the new joiner during week one.<\/p>\n This is what stops the day-two ticket wave reaching your help desk.<\/p>\n Onboarding needs the machine imaged and configured before day one. Offboarding needs it wiped, with proof.<\/p>\n For personal devices, corporate data has to be removed while personal data is preserved<\/a>, which is a different job from a full wipe.<\/p>\n Every action, timestamped. This is what turns your process into audit evidence.<\/p>\n When an auditor asks how long access lingers after departure, you want a report, not an estimate.<\/p>\n Track deprovisioning latency monthly. Track how many day-two tickets each new joiner generates.<\/p>\n Both numbers should fall. If they do not, the trigger is usually why.<\/p>\n Whoever owns endpoint security in your organisation should sign off on three things before this goes live.<\/p>\n Revocation timing by role.<\/strong> Which roles need minute-level revocation and which can wait until end of day.<\/p>\n Device wipe evidence.<\/strong> What proof exists that a returned machine was wiped, and where that record lives.<\/p>\n The exception list.<\/strong> Which systems your automation cannot reach, and who handles them manually.<\/p>\n Getting this signed off early avoids the common failure where IT automates the convenient parts and security discovers the gaps during an audit.<\/p>\n Automation should escalate, not pretend.<\/p>\n A workable rule: the immediate security tier runs automatically for everyone, and the rest gets a human check for senior or sensitive departures.<\/p>\n Our platform covers the endpoint side of both halves. Anakage<\/a> automates system setup, software installation, device wiping, licence allocation, and ID creation and deletion, and adds on-screen guidance so new joiners find self-help in week one rather than calling the help desk.<\/p>\n The endpoint layer is often the missing piece rather than the whole answer. Identity governance tools handle the account and SaaS side well. What they generally do not do is act on the device itself, which is where software installs, policy application and wipes actually happen.<\/p>\n Be clear about the boundary.<\/strong> If your problem is orphaned accounts across fifty cloud applications, an identity governance platform is the right purchase and we would tell you so. If your problem is that provisioning a machine takes three days and offboarding a device takes three weeks, that is our ground.<\/p>\n One honest note. Automation covers the paths you define. Novel situations still need a person, and any vendor promising otherwise is overselling.<\/p>\n What is an orphaned account?<\/strong><\/p>\n A login or system access that still belongs to a former employee after they have left. They appear when HR records a departure but that event does not reliably trigger revocation across IT systems.<\/p>\n How quickly should access be revoked when someone leaves?<\/strong><\/p>\n On the day departure is confirmed for most roles. For privileged roles or access to financial systems, within minutes, using session revocation so devices still logged in lose access immediately.<\/p>\n What is deprovisioning latency?<\/strong><\/p>\n The time between an employee leaving and their access actually being removed. Auditors and cyber insurers increasingly ask for this number, and most organisations cannot produce it.<\/p>\n Why does our onboarding procedure still generate help desk tickets?<\/strong><\/p>\n Usually because the machine gets built but the person gets no guidance. Day-two tickets about printers, drives and VPN are the signal. Adding on-screen guidance in week one removes most of them.<\/p>\n Can helpdesk software handle onboarding and offboarding on its own?<\/strong><\/p>\n It can track the requests and hold the checklist. What it generally cannot do is act on the device, so software installs, policy application and wipes still need either a person or an endpoint automation layer.<\/p>\n How does HRMS onboarding integration help?<\/strong><\/p>\n It removes the human dependency. When a status change in the HR system fires the sequence directly, nothing waits on someone remembering to raise a ticket, and you get a measurable latency figure.<\/p>\n What role does IT asset management play?<\/strong><\/p>\n It defines what each role receives on day one and what must be recovered on the last day. Stale asset records are the most common reason offboarding leaves devices and licences unaccounted for.<\/p>\n Can offboarding be fully automated?<\/strong><\/p>\n The security tier can and should be. Data handover decisions, sensitive exits and physical access generally still need a person.<\/p>\n What should we automate first?<\/strong><\/p>\n The immediate offboarding tier: disable account, revoke sessions, remove group memberships. It carries the most risk and involves no judgement calls.<\/p>\n The gap between someone leaving and their access disappearing is a number you can measure, and most organisations never have. Start there, because it tells you how urgent the rest of this is.<\/p>\n If provisioning and wiping devices is the slow part of your onboarding process, we run a 30 minute walkthrough<\/a> of the endpoint automation side.<\/p>\n Orphaned accounts and offboarding risk:<\/strong> CloudNuro<\/a> \u00b7 Flip on the offboarding process<\/a> \u00b7 RoboMQ on identity governance<\/a> \u00b7 Xantrion IT leader’s guide<\/a><\/p>\n","protected":false},"excerpt":{"rendered":" Automating the onboarding process means connecting one trigger from your HR system to a fixed sequence of actions on the […]<\/p>\n","protected":false},"author":1,"featured_media":8965,"comment_status":"open","ping_status":"open","sticky":false,"template":"","format":"standard","meta":{"_monsterinsights_skip_tracking":false,"_themeisle_gutenberg_block_has_review":false,"footnotes":""},"categories":[33,658],"tags":[],"coauthors":[88],"class_list":["post-8964","post","type-post","status-publish","format-standard","has-post-thumbnail","hentry","category-it-help-desk","category-it-asset-management-itam"],"views":74,"_links":{"self":[{"href":"https:\/\/www.anakage.com\/blog\/wp-json\/wp\/v2\/posts\/8964","targetHints":{"allow":["GET"]}}],"collection":[{"href":"https:\/\/www.anakage.com\/blog\/wp-json\/wp\/v2\/posts"}],"about":[{"href":"https:\/\/www.anakage.com\/blog\/wp-json\/wp\/v2\/types\/post"}],"author":[{"embeddable":true,"href":"https:\/\/www.anakage.com\/blog\/wp-json\/wp\/v2\/users\/1"}],"replies":[{"embeddable":true,"href":"https:\/\/www.anakage.com\/blog\/wp-json\/wp\/v2\/comments?post=8964"}],"version-history":[{"count":1,"href":"https:\/\/www.anakage.com\/blog\/wp-json\/wp\/v2\/posts\/8964\/revisions"}],"predecessor-version":[{"id":8966,"href":"https:\/\/www.anakage.com\/blog\/wp-json\/wp\/v2\/posts\/8964\/revisions\/8966"}],"wp:featuredmedia":[{"embeddable":true,"href":"https:\/\/www.anakage.com\/blog\/wp-json\/wp\/v2\/media\/8965"}],"wp:attachment":[{"href":"https:\/\/www.anakage.com\/blog\/wp-json\/wp\/v2\/media?parent=8964"}],"wp:term":[{"taxonomy":"category","embeddable":true,"href":"https:\/\/www.anakage.com\/blog\/wp-json\/wp\/v2\/categories?post=8964"},{"taxonomy":"post_tag","embeddable":true,"href":"https:\/\/www.anakage.com\/blog\/wp-json\/wp\/v2\/tags?post=8964"},{"taxonomy":"author","embeddable":true,"href":"https:\/\/www.anakage.com\/blog\/wp-json\/wp\/v2\/coauthors?post=8964"}],"curies":[{"name":"wp","href":"https:\/\/api.w.org\/{rel}","templated":true}]}}The number your auditor will ask for<\/h3>\n
What Your Help Desk Actually Sees<\/h2>\n
What to Automate in the Onboarding Process<\/h2>\n
The device side<\/h3>\n
\n
The identity side<\/h3>\n
\n
The user side, which almost everyone skips<\/h3>\n
\n
What to Automate in the Offboarding Procedure<\/h2>\n
Immediate, within minutes<\/h3>\n
\n
Same day<\/h3>\n
\n
The commonly missed items<\/h3>\n
Where IT Asset Management Fits<\/h2>\n
The Trigger Is the Whole Design<\/h2>\n
\n
How to Automate It: Nine Steps<\/h2>\n
1. Map what happens today<\/h3>\n
2. Find your orphaned accounts first<\/h3>\n
3. Discover accounts outside SSO<\/h3>\n
4. Define the roles<\/h3>\n
5. Build the offboarding sequence in two tiers<\/h3>\n
6. Build the onboarding sequence with a self-help layer<\/h3>\n
7. Handle the device<\/h3>\n
8. Log everything<\/h3>\n
9. Measure and re-run<\/h3>\n
What the Endpoint Security Manager Should Review<\/h2>\n
What Still Needs a Person<\/h2>\n
\n
Where Anakage Fits<\/h2>\n
FAQ<\/h2>\n
Sources<\/h2>\n