The problem
Offboarding is one of the highest-stakes IT workflows because the cost of getting it wrong is asymmetric: a missed step leaves an active access path that surfaces in the next security audit or breach. Manual offboarding across Okta, Microsoft 365, Jira, and Intune typically takes 30-45 minutes per departing employee and routinely misses subordinate steps (orphaned OAuth tokens, unrevoked SaaS access, untransferred file ownership).
What AscendCore does
An HR system emits a termination event, or an IT admin initiates offboarding manually. AscendCore proposes the full offboarding flow as a single approval card: account suspension, token revocation, drive ownership transfer, license revocation, mailbox archival. On approval, every step executes with per-step verification and a complete audit trail.
Workflow
- Trigger — HR system webhook or admin-initiated offboarding
- Compose — assemble the full step list based on the user's connected systems
- Propose — single approval card listing every action across every connected system
- Approve — IT admin + HR approval (always required)
- Execute — account suspension, OAuth token revocation, file transfer, license revocation, mailbox archive
- Verify — per-step success confirmation; failures escalated (e.g., legal hold blocks mailbox archive)
- Audit — every action logged with timestamps, approvers, and step-level outcomes for compliance review
Integrations
- Okta — Account suspension, OAuth token revocation
- Microsoft 365 — Drive ownership transfer, license revocation, mailbox archival
- Jira / Atlassian — Project access revocation
- Microsoft Intune — Device deactivation, policy removal
- Slack + Microsoft Teams — Approval and confirmation
Status
Live in production for the core flow (Okta account suspension via the offboard command). Full multi-system orchestration with file transfer and mailbox archive is on the customer-driven roadmap; multi-system runbooks expand as design partners surface specific configurations.
