Offboarding Evidence.
Prove the leaver is gone.
The account is the easy part. The access someone leaves behind is not.
Offboarding Evidence reads your Microsoft 365 tenant, read-only, and turns each departure into auditable evidence: what is still live, who owns it, and the runbook to close it. Leaver evidence in the shape an assessor asks for, at a price a small team can actually run.
NIS2 Article 21(2)(i) names the topic in three words: human resources security, access control policies and asset management. The itemised requirement sits in the implementing act, CIR (EU) 2024/2690, which asks you to modify access rights on termination of employment and to maintain a register of what was granted. Offboarding Evidence is that register, opened in front of an assessor. This is evidence for those objectives, not a certification claim.
What you can check
- 12evidence controls per departure
The evidence model this product runs against carries 12 evidence controls, and every departure produces one evidence row per control.
Counted from EVIDENCE_CONTROLS in the evidence model this product ships. The free scan lists the same 12 and marks each ready, partial or missing, so the count is checkable without buying anything. Per-control pass rates across tenants are not published.
Run the free scan and count them
Offboarding Evidence reads your tenant and writes nothing to it.
Microsoft Graph, read-only. The scope set is published in full, so the absence of a write permission is something you can check rather than something we assert.
See the exact read-only scopes we requestCharged from day one, with a 30-day money-back guarantee on your first payment.
Ask within 30 days of the first payment and it is refunded in full, no reason required, with the subscription cancelled from the date of the request. After that, cancellation from the billing portal takes effect at the end of the current billing period and past months are not pro-rated. The guarantee is written into the Refund Policy, so it is a term rather than a promise on a marketing page.
Refund Policy, section 05Target revocation windows are under 24 hours for a standard departure, under 60 minutes for a sensitive one and under 15 minutes for a hostile one. They are targets by departure risk, and your own team performs the revocation. Nothing here is a guaranteed response time, and no clause makes it one.
Ranked by how you can check it. Only a measured figure is set as one.
The access a departure leaves behind.
Deleting the account is the visible step. The NIS2 implementing act asks for a register of the access that was granted, and the residue below is what an assessor actually finds while the clock is running.
The OAuth grant a disabled user still holds
Deleting the account does not revoke the app tokens it approved. The ChatGPT or Zapier grant a former employee clicked can keep reading mail and files long after the desk is cleared.
The mailbox that keeps forwarding after they leave
A forwarding rule quietly sends copies to a personal address. Nobody set an alert, so it runs until an audit or an incident finally trips over it.
The never-expiring client secret nobody rotated
A workload credential on an app registration owned by someone who left. No expiry, no owner. It is the identity offboarding forgets entirely.
From departure to closed, on the record.
Every step reads or writes something real, and every step leaves a timestamp. This is the offboarding sequence Offboarding Evidence runs, the same one the free scan starts.
- Leaver signalA departure is flagged, from an HRIS trigger or added by hand. The clock against your target revocation window starts on the spot.
- Access inventoryRead-only Microsoft Graph maps what the person can still reach: live sessions, paid licences, OAuth grants, mailbox forwarding rules and owned app registrations.
- Revocation runbookFindings become an idempotent PowerShell runbook, dry-run by default, with a rollback line per step. Your team runs it in your own tenant.
- Verification re-scanA second read confirms the access is actually gone before anyone marks the ticket closed. The gap between claimed and real is the whole point.
- Evidence packThe before, the action and the after export as a board-ready PDF plus findings and remediation CSV, tied to the tenant timeline.
Recurring evidence, one tenant, flat rate.
Offboarding Evidence re-scans on your cadence and keeps every evidence pack, so the offboarding trail is current the day an auditor asks for it.
Recurring Microsoft-first scans
Re-scan on your cadence, every result kept. Departures do not wait for a quarterly review.
A board-ready evidence pack per departure
Exposure score, severity-ranked findings and evidence-completeness, exported as PDF plus findings and remediation CSV.
Executable remediation runbooks
Each fix ships as an idempotent PowerShell runbook (.ps1 + .md), dry-run by default, gated on an $Apply flag.
Regression alerts between scans
When new exposure appears, for example a fresh OAuth grant on a disabled user, you get an alert. Routine changes stay quiet.
MTTFAR trend and posture history
Mean time to full access revocation, tracked over time, so you can show an auditor or the board the direction of travel.
See exactly what Offboarding Evidence delivers
One scan turns a departure into auditable evidence. Offboarding Evidence keeps it live in a tenant workspace, hands you the runbook to fix it, and tracks the trend. Every shot below is a real, shipped surface.
From one scan
The exposure, documented
Connect Microsoft read-only. In minutes you get the evidence pack: access residue on disabled users, the non-human identities offboarding forgets, and any active leaver still in flight.
Evidence completeness
86%
Former users retain OAuth grants
Graph oauth2PermissionGrants
Disabled users still hold paid licenses
Graph subscribedSkus
Forwarding on disabled mailboxes
Exchange inbox rules
The identities offboarding forgets: secrets, tokens and workload apps that outlive the person who made them.
Revocation due now
A privileged leaver was flagged by the HRIS trigger. Offboarding Evidence opens the clock against your target window and tracks what is still open.
24h
Target
11
Access paths
IT Sec
Owner
What Offboarding Evidence adds
Evidence control, not a one-off scan
Offboarding Evidence re-scans on your cadence, keeps every result, and turns findings into an executable runbook. The workspace becomes your offboarding system of record.
Contoso Ltd · 240 users
Connector
Healthy
Last scan
1 Jul 2026
Evidence
86%
MTTFAR
19h
3 disabled users still hold OAuth grants.
# Reclaim licenses from disabled users
$targets = Get-MgUser -Filter 'accountEnabled eq false'
if ($Apply) {
Set-MgUserLicense -RemoveLicenses $skus ...
} else { "WHATIF: would remove 5 licenses" }
Every fix ships as an idempotent PowerShell runbook (.ps1 + .md). Destructive actions are gated on $Apply, with a rollback line per step. You run it in your own tenant.
Offboarding Evidence keeps every scan, so you can prove the direction of travel to an auditor or the board - not just today's number.
Do not take our word for it.
Download the exact sample evidence pack a customer gets - no login, no admin consent.
Offboarding Evidence reads across your whole stack.
Microsoft 365, Entra and Intune are the offboarding core - where most leaver access actually lives - and they scan live today. Google Workspace, ticketing, SIEM, collaboration and HRIS are in active build. One evidence model, never an integration we do not have.
Microsoft 365 · Entra
Intune · Jamf · NinjaOne
Directory · Drive
Jira Service Management
Splunk · Sentinel · Elastic
Slack · Atlassian · Notion
Personio · HiBob · BambooHR
GitHub · GitLab
HaloPSA · ServiceNow
Salesforce · HubSpot
What each connector reads and produces12 connectors
| System | Status | Reads | Produces |
|---|---|---|---|
| Microsoft 365 / Entra ID | Live |
|
|
| Jira Service Management | Building |
|
|
| HaloPSA / ServiceNow / Freshservice / ConnectWise / Autotask | Roadmap |
|
|
| Personio / HiBob / BambooHR | Building |
|
|
| Workday | Building |
|
|
| Google Workspace | Building |
|
|
| Okta / OneLogin / JumpCloud | Live |
|
|
| GitHub / GitLab | Roadmap |
|
|
| Slack / Atlassian / Notion | Building |
|
|
| Salesforce / HubSpot | Roadmap |
|
|
| Intune / Jamf / Kandji / NinjaOne / Atera | Live |
|
|
| Sentinel / Splunk / Elastic | Building |
|
|
Evidence for the frameworks your auditor opens.
Each departure maps to the control objectives behind DORA, NIS2 and ISO 27001, and exports as a timestamped trail. This is evidence for those objectives, not a certification ITSailor holds.
CIR (EU) 2024/2690, Annex 11.2.2(b) and (e): access rights modified on termination of employment, and a register of access rights granted. Each departure produces one dated record.
For requirement 10.3, the accepted evidence reads "Records confirming the timely revocation of access rights". That is the artefact this product exports.
Annex A A.5.18 access rights and A.6.5 responsibilities after termination of employment, evidenced per departure.
Leaver access evidence, sold as a product.
The free scan exposes the risk window. Offboarding Evidence turns that signal into a tenant workspace: recurring evidence, connector health, MTTFAR tracking, exportable packs and a billing trail your team can manage without a heavy identity governance rollout.
Connector Health
Track Microsoft evidence access, scan freshness and re-auth needs from one client workspace.
Evidence History
Keep each scan, risk band, severity count and evidence completeness score tied to a tenant timeline.
MTTFAR Trend
Measure mean time to full access revocation against standard, sensitive and hostile departure targets.
Export Pack
Produce board-ready PDF, findings CSV, remediation CSV and summary evidence for audit reviews.
Shows what a single departure left open and evidences what closed. Point it at a leaver and it works the case to a stated closure status.
Keeps the whole Microsoft 365 estate watched between departures: licence waste, Shadow IT and AI, and posture drift. Same tenant connection pattern, same read-only posture, separate scans and separate evidence.
Two products, one read-only posture. See Tenant MonitorRun both, one invoice.
One subscription that provisions Tenant Monitor and Offboarding Evidence together: evidence-grade offboarding and continuous Microsoft 365 monitoring, on one dashboard.
Same price as both annual plans, billed as one invoice for one onboarding.
€318/mo billed annually
EUR 3816/yr
30-day money-back guarantee. Prices excl. VAT, calculated at checkout.
Start both modulesWhat security and IT leads ask first.
What does the evidence actually look like?
An evidence pack per departure: an exposure score, a severity-ranked finding list (access residue on disabled users, forwarding rules, unrecovered licences), the non-human identities offboarding forgets, and an evidence-completeness score. Each finding names its source, for example a Microsoft Graph oauth2PermissionGrants read, so an auditor can trace where it came from. It exports to a board-ready PDF plus findings and remediation CSV.
What access does Offboarding Evidence need, and can it change anything?
Read-only Microsoft Graph. Offboarding Evidence reads identity, licence, mailbox and app-registration state and writes nothing to your tenant. Remediation ships as a PowerShell runbook that is dry-run by default; your own team runs it, in your own tenant, after review. Nothing on our side is load-bearing. Every scope we request is listed at /trust/scopes.
Where is the evidence stored, and can I delete it?
Evidence is stored encrypted in the EU (Hetzner, Falkenstein). Offboarding Evidence holds read-only access to your tenant, revocable in one step, and nothing on our side is load-bearing. Your evidence history is destroyed on request. See the Trust Center for data handling and sub-processors.
Is this evidence for NIS2 and other audits?
Yes, as evidence, not a certification. NIS2 Article 21(2)(i) names the topic; the itemised requirement is in the implementing act, CIR (EU) 2024/2690, which asks you to modify access rights on termination of employment and to maintain a register of access rights granted. ENISA lists "Records confirming the timely revocation of access rights" as accepted evidence for that requirement. ISO 27001 A.5.18 and A.6.5 cover the same ground, and GDPR Article 32 supports the practice rather than prescribing it. Offboarding Evidence keeps every scan and turns each departure into that record. It maps findings to those control objectives; it does not claim a certification ITSailor does not hold.
How is this different from an offboarding checklist tool?
A checklist records what someone said they did. Offboarding Evidence reads the tenant and shows what is actually still there: the OAuth grant a disabled user still holds, the never-expiring client secret, the paid licence nobody reclaimed. The output is auditable evidence plus an executable runbook, not a set of ticked boxes.
Does Offboarding Evidence revoke access on its own?
No. Today it produces the evidence and a dry-run remediation runbook that your team executes. Automated, human-approved remediation is the Act tier, which is in build and starts with session revocation. Nothing on the page implies autonomy that does not exist yet.
What does it cost, and how does VAT work?
€249/month, or €199/month billed annually, for one tenant workspace. Prices are excl. VAT; VAT is calculated at checkout, and eligible EU B2B buyers outside Malta reverse-charge. There is no trial: you are charged from day one and covered by a 30-day money-back guarantee, and you can cancel anytime.
Can I see the output before I buy?
Yes. Run the free exposure scan on the tool page, or download the exact sample evidence pack a customer gets, with no login and no admin consent. See all sample artifacts.
Leave the offboarding trail before anyone asks to see it.
Every departure produces the same artefacts on the day the account closes, whether or not someone remembers to file them. Connect Microsoft read-only and the first pack is free.
The pack Offboarding Evidence renders, built from fixed sample data for a demo company rather than a real tenant, and it says so on the cover. No account and no email.