# Shut off Okta access when BambooHR says someone has left

> Every weekday at 6pm, we find employees whose last day has passed, close their Okta accounts, sign them out everywhere, and open an IT ticket.

- Workflow type: agent
- Services: Okta, BambooHR, Jira Service Management, Slack
- Categories: HR & People, Operations
- Published: 2026-08-09

## What it does

- Checks your HR records every weekday evening for people whose last working day has already passed, and leaves anyone with a future leaving date completely alone.
- Closes the account of anyone who still has access and signs them out of every device and app immediately, so there is no overnight window where a former employee can still log in.
- Records which apps each person could still reach before the access is removed, so you keep a written trail of exactly what was taken away.
- Opens one IT ticket per person for the manual follow ups like laptop return and licence reclaim, then posts a single Slack summary covering who was closed, who was already handled, and any HR record with no matching account.

## What you'll need

- A BambooHR account with permission to read employee records, including termination dates for people who have left
- An Okta account with admin rights to close user accounts and sign users out
- A Jira Service Management project where IT offboarding requests should be raised
- A Slack workspace and a channel for the summary, for example #it-offboarding

## Prompt

Every weekday at 6pm in my workspace timezone, sweep BambooHR for employees whose termination date has already passed and make sure their Okta access is genuinely shut off. Use a cron trigger running Monday through Friday. BambooHR does not emit an outgoing webhook for termination events, so an end of day scheduled sweep is the right shape. Build this as an agent, because matching HR records to identity accounts is fuzzy and the workflow has to decide per person whether to act, whether to skip, or whether to escalate a mismatch to a human.

Step 1, find who has left. Pull the roster with Get Employee Directory in BambooHR to get current identity and job fields, including work email, display name, department and job title. The directory on its own does not carry termination dates and generally lists current employees only, so also run Request Custom Report asking for the fields that actually matter here: employee status, termination date, work email, display name, department, job title and supervisor, with terminated employees included. Treat that report as the authoritative list of leavers and the directory as the identity cross check. Select only people whose termination date is today or earlier. Never touch anyone whose last working day is still in the future. That is the single most important rule in this workflow.

Step 2, match each leaver to their Okta account by work email. Use Retrieve User in Okta with the work email as the login, since Okta user lookups accept the id, the login, or the login shortname. If that lookup does not resolve, fall back to List Users with a search expression on the profile email so you also catch people whose Okta login differs from their BambooHR work email, for example a changed surname or an alias domain. Email matching between these two systems is the fragile step in this entire workflow. If you still cannot find an account, do not quietly skip the person. Record them as an unmatched record and report them in the Slack summary so IT can investigate the mismatch by hand.

Step 3, capture the access before you remove it. For every matched person who is still active, call List User App Links in Okta first and record every app they can still reach. Do this before deactivating, because once the account is deprovisioned the assigned app list is no longer reliably readable, and the whole point is that the record shows exactly what access was removed. Keep those app names for the ticket.

Step 4, cut the access. Call Deactivate User in Okta, which revokes sessions and moves the account to DEPROVISIONED, then follow it with Revoke All User Sessions with OAuth token revocation enabled. The second call is deliberate belt and braces: it clears refresh tokens that could otherwise keep a downstream app session alive after the account is closed. Only ever deactivate. Never call Delete User under any circumstances. Deletion is irreversible, and if a termination date was entered wrongly the account has to be recoverable. If someone is already DEPROVISIONED or SUSPENDED, treat them as already handled: do not deactivate again, do not raise a second ticket, and simply note them in the summary. That is what keeps this sweep safe to run every single evening.

Step 5, raise the follow ups. For each person you deactivated, use Create Customer Request in Jira Service Management to open one ticket in our IT service desk. Name the person in the summary field. In the description include their work email, their termination date, their department and job title, confirmation that the account was deactivated and sessions revoked, and the full list of apps they still had access to from step 3. Add a checklist for the manual work that software cannot do: laptop and equipment return, licence and seat reclaim for the apps listed, mailbox delegation, and building or badge access. One ticket per person, never one merged ticket for the whole run.

Step 6, post the summary. Use Send a Message in Slack to post a single summary to our IT channel, for example #it-offboarding. Structure it as three clearly separated groups: who was deactivated in this run, with the ticket link and the apps reclaimed for each; who was already handled, so IT knows the sweep saw them and chose not to act; and any BambooHR record with no matching Okta account, called out as needing investigation. The mismatch group matters most, so do not bury it at the bottom of a wall of text. If nobody has left and there are no mismatches, post nothing and finish quietly.

Handle each person independently so one bad record cannot block the rest of the sweep. If deactivation fails for someone, still raise their ticket and still name them in Slack, and flag the failure loudly in both so a human picks it up. If BambooHR returns a throttling response, back off and retry rather than silently dropping people from the run.

## How to customize

- Change the 6pm run time, or run the sweep more than once a day so access is cut sooner after someone's last day
- Point the tickets at a different IT queue or request type, and change what the manual follow up checklist covers
- Choose which Slack channel gets the summary, and whether to stay silent on days when nobody has left

## Example output

Offboarding sweep, Friday 6pm

Deactivated (2)
- Dana Whitfield, Sales, last day 6 Aug. Signed out everywhere. 7 apps reclaimed including Salesforce, Zoom, Figma. Ticket ITS-4182
- Marcus Bell, Support, last day 7 Aug. Signed out everywhere. 4 apps reclaimed including Zendesk, Confluence. Ticket ITS-4183

Already handled (1)
- Priya Raman, Engineering, last day 1 Aug. Account was already closed, no action taken.

No matching account (1)
- Tomas Vidal, Contractor, last day 5 Aug. No Okta account found for tomas.vidal@acme.com. Please investigate.

## FAQ

### Will this ever delete someone's account?

No. It only ever closes accounts, never deletes them. Deletion cannot be undone, so if a leaving date was entered by mistake or someone comes back, the account is still there to be restored. Permanent deletion stays a deliberate human decision.

### What happens if someone's leaving date is still in the future?

Nothing at all. The sweep only picks up people whose last working day is today or earlier, so anyone with a future leaving date is left untouched until their date actually arrives.

### What if an employee has no matching account in Okta?

They are called out in the Slack summary as needing investigation rather than being quietly skipped. Matching people between your HR system and Okta relies on work email, so a mismatch usually means the email differs between the two systems, and someone needs to check it by hand.

### Will it raise a duplicate ticket for the same person every evening?

No. Before acting it checks whether the account is already closed. If it is, that person is reported as already handled, with no second ticket and no repeated action, so the sweep is safe to run every day.

### Can we get someone's access back if HR made a mistake?

Yes. Because accounts are closed rather than deleted, an administrator can reactivate the account and restore access. That buffer is the whole reason this workflow never deletes anyone.

Use this prompt in General Input: https://www.generalinput.com/prompts/shut-off-okta-access-when-bamboohr-says-someone-has-left