GuidesOffboard someone
On this page0

Guide

Offboard someone

Cut a leaver's access, close their accounts in connected systems, and track the return of their hardware until nothing is left open.

For: HRPlan: All plans

Before you start

  • Your role must let you manage users. On a new instance only administrators have that permission. If it does not, the offboard icon shows “Access Restricted”.
  • An offboarding pipeline that is live. Every instance comes with one called “Master Offboarding” (Departure Trigger, then Manager Approval).
  • The person should have a persona. Their persona is how Zonitix knows which apps and licences to take back. Without one, only their source directory account (if they came from Okta, Entra or Google) is covered.
  • Decide the timing first. Offboarding removes their Zonitix sign-in the moment you start it, not on their last day.
  • If the person wants a copy of their personal data, ask them to download it before you start: on My Profile they click “REQUEST PII EXPORT (SAR)”. Once their sign-in is gone, the copy takes a request to the API; see step 2 of Handle a personal-data request.
Need them to keep working until their last day? Do not start offboarding yet. Instead open their row in AdministrationUsers, click “Edit”, set “Termination date (schedule offboarding)” in the Organization section, save, and confirm “Schedule offboarding”. On that date the same offboarding starts on its own. Clear the date to cancel.

Start the offboarding

  1. Step 1: Find the person

    Go to AdministrationUsers and find them in the list. Hover the icons on their row and click “Offboard (deprovision + reclaim)”. In plain words, the label means close their accounts and take back their equipment.

  2. Step 2: Check what will be revoked

    The “Offboard” window lists “This will revoke”: their Zonitix sign-in, roles and group memberships, plus every app and licence from their persona.

  3. Step 3: Choose how they leave

    “Scheduled departure” is the normal case. Optionally set a “Last working day”; the reclaim and revoke tasks are dated to it. Click “Start offboarding”.

    “Terminate now” is for someone who must lose everything immediately. Type a “Reason” (it is recorded on the run and in the audit log), then click “Terminate now”. Every automatic revoke step runs straight away, and anything that cannot be revoked automatically becomes an IT task due today.

What happens straight away

  1. Step 4: Their Zonitix access ends

    Either way, the moment you confirm, their status becomes Offboarded and they can no longer sign in. All their roles and group memberships are removed, so if they are ever rehired they start with no elevated access.

    An offboarding run named after them is created in ExecutionWorkflow Tasks, and IT and their manager are emailed if email is set up.

    Offboarding also creates the person’s leaving record on their employee file. HR records the reason, the rehire decision and the exit checklist there, and People Reports and the payroll hand-off count leavers from it: see Record that someone is leaving.

Work the run

  1. Step 5: HR completes the departure step

    For a scheduled departure, the run starts at “Departure Trigger” in the HR queue, with the person’s details already filled in. HR opens it with “Open & complete step” and clicks “Complete step”. (For “Terminate now” this step is recorded as completed by you.)

  2. Step 6: The manager approves the departure

    “Manager Approval” goes to their manager. They can choose who gets the mailbox and files in “Hand off mailbox & files to”, then click “Approve & continue”.

  3. Step 7: Close their accounts in connected systems

    Each connected system from their persona gets its own revoke step. The default offboarding pipeline is set to “Runs manually”, so these steps show “WAITING TO RUN” and their access stays live until an administrator opens the step and clicks “Revoke access now”.

    To have these run on their own, change the pipeline to “Accounts automatic” in ExecutionWorkflow BuilderManage under “AUTOMATION”.

  4. Step 8: IT revokes the rest by hand

    Apps without a connector (a saved connection between Zonitix and that app) land on IT as one checklist, due on the last working day. IT removes each one, ticks it, and clicks “Complete step”. The step cannot be completed until every item is ticked.

  5. Step 9: IT recovers the hardware

    Each device in their persona gets a recovery step for IT. If the persona lists no hardware but a device is assigned to them in Zonitix, a recovery step is added for that too. IT fills in “Asset Tag to Reclaim” and “Device Condition”, and confirms the device was collected and the drive wiped. Type the computer’s serial number in “Asset Tag to Reclaim”: that is the value Zonitix compares it with, and a tag that differs from the serial leaves the computer held instead of returned to stock. Zonitix does not wipe the drive; the tick records that a person did.

Confirm everything is done

  1. Step 10: Read the run summary

    Open the run in “Workflow Tasks”. The box at the top shows either “All access revoked — nothing left live.” or “Access may still be live” with the steps still open.

    That box covers the automatic revoke steps and hardware recovery. Check the manual IT checklist steps are complete too. When every step is done, the run moves to the “History” tab, and “View full audit” shows who did what.

What you should see

In Users, the person’s status reads “OFFBOARDED” and they cannot sign in.

In Workflow Tasks, their run shows “All access revoked — nothing left live.” and sits under “History” once every step is complete.

If something goes wrong

"You cannot offboard your own account."
Zonitix refuses self-offboarding. Ask another administrator to do it.
"The primary administrator cannot be offboarded."
This is by design: the primary administrator account is protected so your instance can never be locked out. It cannot be offboarded, disabled or deleted, from this screen or any other. If the person who holds it is leaving, follow When your main administrator leaves.
The Terminate now button stays greyed out, or "An immediate termination needs a reason on the record."
Type a reason of at least five characters. It is required for an immediate termination only.
"Platform access was revoked, but NO deprovisioning run was created"
Their Zonitix sign-in is gone, but there is no live offboarding pipeline, so nothing else was started. Close their connected accounts by hand now, and make an offboarding pipeline live in Workflow Builder.
A revoke step says "Held for a second administrator".
Ten directory accounts had already been disabled within the last hour, so Zonitix paused the next one as a safety measure. The account stays enabled until a different person who can open Identity Hooks and is allowed to approve identity changes (an administrator always is) goes to Access Governance, then Identity Hooks, clicks Review on the notice at the top, and approves it. This works on every plan.
"… terminated — sign-in revoked … but N item(s) are still open."
Some accounts could not be closed automatically. Open the run in Workflow Tasks to see exactly which ones, and close them by hand.

Still stuck? See When something goes wrong, or Contact Zonitix support.

Where next

Previous
Onboard your first hire
Next
Work through workflow tasks