# Log every offboarding to Slack, Sheets, and your audit trail

> The moment someone loses access in a customer's corporate directory, the removal is announced, logged to a spreadsheet, and written into their compliance record.

- Workflow type: code
- Services: WorkOS, Slack, Google Sheets
- Categories: Operations, HR & People
- Published: 2026-08-10

## What it does

- Watches your identity system for the moment a person is deactivated or removed from a customer's corporate directory
- Posts the details to your IT security channel right away: who was removed, which customer, and which directory the change came from
- Adds a matching row to a running offboarding log, with the same five columns in the same order every single time
- Writes the removal into the customer's own compliance record, so their audit trail shows exactly when access ended

## What you'll need

- A WorkOS account with directory sync connected for at least one customer organization
- A Slack workspace, plus the channel your IT security team actually watches
- A Google account and a spreadsheet set aside for the offboarding log
- A tab in that spreadsheet with five columns: date, email, organization, directory, event type

## Prompt

Run this as a webhook workflow. WorkOS should call it whenever Directory Sync reports that a user has been deactivated or removed from a customer's corporate directory: the dsync.user.deleted event, and dsync.user.updated when the user's state changes to inactive or suspended. Every delivery represents exactly one offboarding to record.

From the webhook payload, pull five values and reuse them everywhere downstream: the event timestamp (this is the date), the directory user's primary email address, the WorkOS organization id the directory belongs to, the directory id the change came from, and the event type. Do not summarize, score, enrich, or interpret anything. Every step below is a fixed field mapping.

First, use Slack Send a Message to post to our IT security channel. The message states that a directory user was deprovisioned and lists the user's email address, the organization, the directory the change came from, the event type, and when it happened. Use the same message format on every run.

Second, use Google Sheets Append Values to add one row to our running deprovisioning log. The columns are fixed and always in this order: date, email, organization, directory, event type. Append only, never overwrite, and never add, reorder, or rename columns between runs so the sheet stays sortable and auditable.

Third, use WorkOS Create an Audit Log Event to write the removal into the customer's own audit trail. Set organization_id to the organization from the payload, use a single consistent action name such as user.deprovisioned on every run, map the directory user as the actor and the same user plus the directory as the targets, and set occurred_at from the event timestamp.

WorkOS can redeliver a webhook, and a double-logged termination inside a compliance record is a real problem. Send an Idempotency-Key request header on the audit log write, set to the WorkOS event id, so a repeated delivery does not create a second entry.

Keep this fully deterministic: no branching, no reasoning step, no optional fields, no judgement calls. If a value is missing from the payload, write an empty cell rather than guessing, and still post to Slack and still write the audit log event.

## How to customize

- Change which Slack channel gets the alert, or route it to a private security channel instead of a shared one
- Point the log at a different spreadsheet or tab, or add extra columns such as manager or department
- Decide whether both deactivations and deletions count as offboarding, or only full removals

## FAQ

### What counts as someone being removed?

When the corporate directory you sync marks a person as deactivated or deletes them outright, the workflow treats that as an offboarding and records it in all three places.

### Does this actually revoke the person's access?

No. The directory does that on its own. This workflow captures the evidence that it happened, which is the part teams usually forget until an auditor asks.

### Will the same removal ever get logged twice?

No. Each removal carries its own identifier, and the workflow uses it when writing to the compliance record, so a repeated delivery does not create a duplicate entry.

### Can I use a spreadsheet I already have?

Yes, as long as the columns match. The workflow always writes date, email, organization, directory, and event type in that order, and it only ever adds rows to the bottom.

### Do I need to be a developer to set this up?

No. You connect the accounts, pick a channel and a spreadsheet, and the workflow runs on its own from then on.

Use this prompt in General Input: https://www.generalinput.com/prompts/log-every-offboarding-to-slack-sheets-and-your-audit-trail