Observable condition
An employee leaves, HR closes the personnel process, but technology access unwinds unevenly. One account is disabled immediately, another application remains active, a licence stays assigned, and group or team memberships are removed only when somebody later notices.
Realisation
The problem is not simply that someone forgot a task. The business has treated one lifecycle event as a collection of unrelated reminders. The more systems and teams involved, the less reliable memory becomes as the control layer.
Identification
This is an employee-lifecycle and access-offboarding workflow problem. HR owns the business event, but identity, application, device, finance and operational controls must respond coherently to it.
Diagnosis
Common causes include no authoritative termination date, inconsistent application ownership, manual notifications, missing inventory of access, contractor accounts outside the HR lifecycle, and no exception queue for actions that fail. Microsoft Entra Lifecycle Workflows explicitly models joiner, mover and leaver phases and supports leaver tasks such as disabling accounts, removing group or Teams membership, removing licences and deleting accounts. The broader principle is that access lifecycle can be event-driven and governed.
Commercial impact
The Commercial Value Wrapper is risk, administrative capacity, continuity and scale. Manual offboarding creates recurring checking work and becomes harder to control as headcount, applications and external workers grow. It also leaves uncertainty about whether former users retain unnecessary access.
Common misidentification
A quarterly access review may find old accounts, but it is a detective control after the lifecycle event. The deeper opportunity is to improve the offboarding workflow so access changes occur from a reliable trigger and failures are visible.
Possibility
A better state has a clear employee status source, named application owners, standard leaver actions, automated steps where appropriate, evidence of completion and an exception path for systems that cannot be updated automatically.
Intervention
Map the exit event from HR through identity, devices, applications, groups, licences and third-party systems. Define which actions happen immediately, which depend on role or legal requirements, and who owns exceptions. Then automate the repeatable parts without losing approval or auditability.
Practical diagnostic questions
- Which system is authoritative for an employee's end date?
- Do you know every business-critical system the employee may access?
- Which exit actions still depend on email or memory?
- How are contractors and temporary workers handled?
- Can failed offboarding actions be seen and escalated?
Bottom line
When offboarding leaves access behind, the business is seeing a lifecycle orchestration gap. The fix is not better remembering; it is a controlled workflow that connects the employee event to the systems that must respond.
Sources and further reading
- Microsoft Entra ID Governance — lifecycle workflows
- Microsoft Entra ID Governance — lifecycle workflow deployment