Revoke Bitwarden access when someone leaves in BambooHR
Every weekday morning we compare your password vault against your HR records and suspend access for anyone who has already left.
Bitwarden
BambooHR
Slack BotOperationsHR & PeopleData SyncNotifications & AlertsEvery weekday at 7am, reconcile my Bitwarden organization against our BambooHR employee directory so that people who have left the company never keep access to the shared vault.
Start by pulling the full employee directory from BambooHR with Get Employee Directory, and the complete member roster for my Bitwarden organization with List Members. Match the two lists on work email address. What I am looking for is every Bitwarden member who is currently active but is no longer an active employee in BambooHR, either because they have been terminated or because they no longer appear in the directory at all.
For each departure you are confident about, call Revoke Member Access. Do not call Remove Member. Revoking suspends the person's access while keeping the membership restorable, so if a match turns out to be wrong we can put them back with their previous role and collection assignments intact. Remove Member frees the seat irreversibly, which is not something I want happening unattended. Do not try to achieve this with a member update call either, because Bitwarden treats update bodies as full replacements and would reset any field you did not resend.
Leave anything ambiguous untouched instead of guessing. Contractors and vendors often hold vault access but never appear in BambooHR at all. Shared service accounts such as it-admin@ or billing@ do not belong to any single person. Some people sign in to Bitwarden with a personal address or an email alias that does not match their BambooHR work email. None of those should be revoked. Collect them for a human to decide on.
Finish by sending exactly one Slack message to our IT security channel with Send a Message. List everyone whose access was revoked, with their email and the reason, then separately list everyone who needs a human decision, with a one line note on why each one was unclear. If there was nothing to revoke and nothing ambiguous, still post the message saying the reconciliation ran clean. I want to see that it ran rather than be met with silence.
Example output
What does this prompt do?
- Checks your Bitwarden member list against your BambooHR employee directory every weekday at 7am, matching people on their work email address.
- Suspends vault access for anyone who is still an active Bitwarden member but is no longer an active employee, so departures never keep a way in.
- Suspends rather than deletes, so a seat can be restored with their old permissions if someone was flagged by mistake.
- Leaves contractors, shared accounts, and mismatched email addresses alone, and hands them to you as a short review list instead of guessing.
What do I need to use this?
- A Bitwarden Teams or Enterprise organization, plus an owner who can generate the organization API key
- A BambooHR account with permission to view the employee directory
- A Slack workspace and a channel where your IT or security team gets alerts
How can I customize it?
- Change the timing so it runs every weekday, once a week, or only on the first working day of the month.
- Point the summary at a different Slack channel, or send it as a direct message to whoever owns access reviews.
- Adjust what counts as ambiguous, for example always skipping a known list of shared service accounts or contractor addresses.
FAQs
Could this lock someone out by mistake?
What happens to contractors who are not in our HR system?
What if someone's vault email is different from their HR email?
Do I still get a message on days when nobody has left?
Do I need a paid Bitwarden plan?
Related templates
When someone leaves, we check which shared passwords they used in their final months and post a ranked rotation list to your security channel.
Every Monday, check every S3 bucket for public exposure, missing encryption and weak backup settings, then get the risks ranked in Slack.
Twice every weekday, the conversations from your social inbox land on the right HubSpot contact timelines, with a Slack recap for sales.
Every morning, find the addresses that hard bounced or filed a spam complaint, update the matching HubSpot contacts, and post a short Slack recap.
Every weekday at 4pm, spot the threads that went quiet, stage a ready-to-send nudge in your mailbox, and get a ranked Slack recap.
When you merge a fix in GitHub, this agent checks the matching dead-letter queue, replays the failed messages, and reports back on the pull request and in Slack.
Stop letting former employees keep vault access.
Set this up once and every weekday morning your password vault gets reconciled against your HR records, with a clear summary waiting in Slack.