Identity Live in production

Guest Account Cleanup

Remove a stale external guest account from Slack or Teams in one approval-gated pass. A safety gate refuses member accounts, and removal is restorable for 30 days.

Integrates with

Entra ID

The problem

External collaboration leaves a trail of guest accounts. Vendors finish projects, partners move on, and the guest invitations stay in the directory with access to whatever they were once shared.

What AscendCore does

A requester names the guest account (and optionally why) in Slack or Teams. AscendCore resolves it in Microsoft Entra ID and posts an approval card with destructive-action styling, because this one deletes. At execution the account's directory type is re-verified: only an account marked Guest is removed, and a member account is always refused, even if one was somehow proposed. Removal is a soft delete with a 30-day recycle bin, restorable from the Entra portal, and every decision lands in the audit chain.

Status

Live in production. Runs against real Microsoft Entra ID tenants today with the execute-time guest safety gate verified in production (a member account was refused before any guest was removed) and a full audit trail.

Runbook source preview

Versioned, deterministic, auditable

Every runbook is defined as a versioned YAML manifest with explicit triggers, steps, and approval policies. The runbook itself is the audit-ready record of what AscendCore can and will do. Chat is just the interface that triggers it.

name: guest-account-cleanup
trigger:
  channels: [slack, teams]
  commands: [guest-cleanup]
steps:
  - resolve_guest_account       # Entra ID
  - admin_approval              # destructive-action styling
  - verify_guest_type           # safety gate, re-checked at execute time
  - remove_guest                # soft delete, 30-day recycle bin
approval:
  required: true
  approvers: [it-admins]

Ready to deploy

Run guest account cleanup from Teams or Slack today

AscendCore deploys in days, not months for Slack + Okta or Teams + Entra stacks. See your first automated resolution the same day.

See plans & pricing Browse all runbooks

More identity runbooks

Live

Access Role Change

Multi-system orchestrated role transitions for promotions, transfers, and contractor-to-FTE conversions. Five seed roles ship out of the box (support tiers, sales SDR/AE, engineering contractor/FTE/intern, HR generalist/manager); each transition produces a single approval card showing the full access diff and executes sequentially across Okta + Entra + Jira + M365 with per-step audit outcomes.

Live

Account Unlock

Automate Microsoft Entra ID and Okta account unlocks from Slack and Teams. Identity verification, approval-gated unlock, failed-login counter reset.

Live

Compromised Account Response

Contain a suspected account compromise in one approval: revoke every active session, invalidate the password, and force MFA re-enrollment, fully audited.