Revoke Bitwarden access when someone leaves in BambooHR
Every weekday morning we compare your password vault against your HR records and suspend access for anyone who has already left.
Bitwarden
BambooHR
Slack BotOperationsHR & PeopleData SyncNotifications & AlertsEvery weekday at 7am, reconcile my Bitwarden organization against our BambooHR employee directory so that people who have left the company never keep access to the shared vault.
Start by pulling the full employee directory from BambooHR with Get Employee Directory, and the complete member roster for my Bitwarden organization with List Members. Match the two lists on work email address. What I am looking for is every Bitwarden member who is currently active but is no longer an active employee in BambooHR, either because they have been terminated or because they no longer appear in the directory at all.
For each departure you are confident about, call Revoke Member Access. Do not call Remove Member. Revoking suspends the person's access while keeping the membership restorable, so if a match turns out to be wrong we can put them back with their previous role and collection assignments intact. Remove Member frees the seat irreversibly, which is not something I want happening unattended. Do not try to achieve this with a member update call either, because Bitwarden treats update bodies as full replacements and would reset any field you did not resend.
Leave anything ambiguous untouched instead of guessing. Contractors and vendors often hold vault access but never appear in BambooHR at all. Shared service accounts such as it-admin@ or billing@ do not belong to any single person. Some people sign in to Bitwarden with a personal address or an email alias that does not match their BambooHR work email. None of those should be revoked. Collect them for a human to decide on.
Finish by sending exactly one Slack message to our IT security channel with Send a Message. List everyone whose access was revoked, with their email and the reason, then separately list everyone who needs a human decision, with a one line note on why each one was unclear. If there was nothing to revoke and nothing ambiguous, still post the message saying the reconciliation ran clean. I want to see that it ran rather than be met with silence.
Example output
Additional information
What does this prompt do?
- Checks your Bitwarden member list against your BambooHR employee directory every weekday at 7am, matching people on their work email address.
- Suspends vault access for anyone who is still an active Bitwarden member but is no longer an active employee, so departures never keep a way in.
- Suspends rather than deletes, so a seat can be restored with their old permissions if someone was flagged by mistake.
- Leaves contractors, shared accounts, and mismatched email addresses alone, and hands them to you as a short review list instead of guessing.
What do I need to use this?
- A Bitwarden Teams or Enterprise organization, plus an owner who can generate the organization API key
- A BambooHR account with permission to view the employee directory
- A Slack workspace and a channel where your IT or security team gets alerts
How can I customize it?
- Change the timing so it runs every weekday, once a week, or only on the first working day of the month.
- Point the summary at a different Slack channel, or send it as a direct message to whoever owns access reviews.
- Adjust what counts as ambiguous, for example always skipping a known list of shared service accounts or contractor addresses.
FAQs
Could this lock someone out by mistake?
What happens to contractors who are not in our HR system?
What if someone's vault email is different from their HR email?
Do I still get a message on days when nobody has left?
Do I need a paid Bitwarden plan?
Related templates
Every weekday, find every unpaid JobNimbus invoice, email each customer one reminder that gets firmer as it ages, and post a receivables summary to Slack.
Every weekday at 7am, your active courses are checked for missing work, silent logins, and slipping grades, with a ranked list sent to your advising channel.
Every hour, find the tickets closest to breaching, leave a nudge on each one, and post a ranked at-risk list to your support channel.
Every weekday afternoon, each student who is behind gets a warm, personal message in their Canvas inbox listing exactly what they owe.
Every Monday at 8am, see exactly which assignments have work waiting, sorted worst first, posted to Slack and logged to a spreadsheet.
When someone asks a library or framework question in your help channel, they get a straight answer with working code and a source link, right in the thread.
Stop letting former employees keep vault access.
Set this up once and every weekday morning your password vault gets reconciled against your HR records, with a clear summary waiting in Slack.