# Revoke Bitwarden access when someone leaves in BambooHR

> Every weekday morning we compare your password vault against your HR records and suspend access for anyone who has already left.

- Workflow type: agent
- Services: Bitwarden, BambooHR, Slack Bot
- Categories: Operations, HR & People
- Published: 2026-08-04

## What it does

- Checks your Bitwarden member list against your BambooHR employee directory every weekday at 7am, matching people on their work email address.
- Suspends vault access for anyone who is still an active Bitwarden member but is no longer an active employee, so departures never keep a way in.
- Suspends rather than deletes, so a seat can be restored with their old permissions if someone was flagged by mistake.
- Leaves contractors, shared accounts, and mismatched email addresses alone, and hands them to you as a short review list instead of guessing.

## What you'll need

- A Bitwarden Teams or Enterprise organization, plus an owner who can generate the organization API key
- A BambooHR account with permission to view the employee directory
- A Slack workspace and a channel where your IT or security team gets alerts

## Prompt

Every weekday at 7am, reconcile my Bitwarden organization against our BambooHR employee directory so that people who have left the company never keep access to the shared vault.

Start by pulling the full employee directory from BambooHR with Get Employee Directory, and the complete member roster for my Bitwarden organization with List Members. Match the two lists on work email address. What I am looking for is every Bitwarden member who is currently active but is no longer an active employee in BambooHR, either because they have been terminated or because they no longer appear in the directory at all.

For each departure you are confident about, call Revoke Member Access. Do not call Remove Member. Revoking suspends the person's access while keeping the membership restorable, so if a match turns out to be wrong we can put them back with their previous role and collection assignments intact. Remove Member frees the seat irreversibly, which is not something I want happening unattended. Do not try to achieve this with a member update call either, because Bitwarden treats update bodies as full replacements and would reset any field you did not resend.

Leave anything ambiguous untouched instead of guessing. Contractors and vendors often hold vault access but never appear in BambooHR at all. Shared service accounts such as it-admin@ or billing@ do not belong to any single person. Some people sign in to Bitwarden with a personal address or an email alias that does not match their BambooHR work email. None of those should be revoked. Collect them for a human to decide on.

Finish by sending exactly one Slack message to our IT security channel with Send a Message. List everyone whose access was revoked, with their email and the reason, then separately list everyone who needs a human decision, with a one line note on why each one was unclear. If there was nothing to revoke and nothing ambiguous, still post the message saying the reconciliation ran clean. I want to see that it ran rather than be met with silence.

## How to customize

- Change the timing so it runs every weekday, once a week, or only on the first working day of the month.
- Point the summary at a different Slack channel, or send it as a direct message to whoever owns access reviews.
- Adjust what counts as ambiguous, for example always skipping a known list of shared service accounts or contractor addresses.

## Example output

Bitwarden access reconciliation for Tue 4 Aug

Revoked (2)
• dana.whitfield@acme.com, Support Specialist, terminated in BambooHR on 1 Aug
• marcus.lee@acme.com, Account Executive, terminated in BambooHR on 28 Jul

Needs a human decision (3)
• it-admin@acme.com: shared service account, no matching employee record
• j.okafor@contractors.acme.com: not in the employee directory, looks like a contractor
• sam.r@acme.com: no exact directory match, closest is samantha.rivera@acme.com

Checked 214 employees against 187 vault members.

## FAQ

### Could this lock someone out by mistake?

It only suspends access, which keeps the membership intact and can be undone in a click. Nothing is permanently deleted, and anything it is unsure about is left completely untouched and reported to you instead.

### What happens to contractors who are not in our HR system?

They are left alone. Anyone with vault access who never appears in your employee directory shows up in the Slack summary as needing a human decision rather than having their access pulled.

### What if someone's vault email is different from their HR email?

It will not guess. When the two addresses do not line up, the person is flagged for review and their access stays exactly as it is until someone confirms.

### Do I still get a message on days when nobody has left?

Yes. It posts a short note confirming the check ran and found nothing, so a quiet day never gets confused with a broken workflow.

### Do I need a paid Bitwarden plan?

Yes. Connecting an organization for automation requires a Bitwarden Teams or Enterprise plan, since the organization API key is not available on free or personal accounts.

Use this prompt in General Input: https://www.generalinput.com/prompts/revoke-bitwarden-access-when-someone-leaves-in-bamboohr