Leaver and joiner automation
Leavers lose access the day they leave.
One HR event starts the chain: account, groups, licence, mailbox and apps for a joiner, and the same chain in reverse for a leaver. I build it per client in your tenant, in Power Automate or n8n, and every run writes to a log you own. It is not yet running at a client.
- PrepareBefore the last day
- At exitT0, the moment access ends
- T+1 dayThe day after
- T+30 daysOne month later
- T+90 daysThree months later
Build a leaver runbook with the Offboarding Runbook and Leaver Check
- For
- An IT or HR lead of a 20 to 250 person firm whose leavers keep access for days.
- Length
- The audit takes one week. The build takes two to four weeks.
- Who does it
- Michal Jatczak, directly. Built in your tenant, not on my systems.
- After the call
- A written scope and a fixed price before any flow is built.
You leave with
HR trigger
Personio, BambooHR, HiBob or a structured HR mailbox starts the chain, in Power Automate or n8n, in your tenant.
Joiner chain
Account, groups, licence, mailbox and app seats set by department and role, ready on the start date.
Leaver chain
Sessions and tokens revoked, sign-in blocked, mailbox shared, OneDrive archived, seats and licence returned. Executive accounts wait for a manual approval.
A run log you own
Every run writes who, what and when, kept as long as you need, with a quarterly access-review export.
Exit Kit
The flows, the runbooks and the access I held, documented so your team or another supplier can run it.
How it runs
Lifecycle audit, one week
Your joiner, mover and leaver flow mapped step by step, the read-only leaver check run on your tenant, and the seat cost of leavers worked out from your numbers.
Build, two to four weeks
The HR trigger, the joiner chain and the leaver chain, tested on test accounts before any real person goes through them.
Hand over
Runbooks in your repository, the run log, and the Exit Kit.
What is not included
Devices
Enrolling and wiping laptops is the device baseline, a separate engagement.
Your HR system
I connect to the HR system you have. Changing or configuring it is not part of the work.
Other automations
Approvals, invoice checks and helpdesk triage are workflow engineering, scoped on their own.
Check it before you book
The free offboarding runbook covers a Microsoft 365 leaver from before the last day to 90 days after, and the optional read-only leaver check lists what disabled accounts in your tenant still hold.
The free SaaS Auditor finds the licences and app seats you still pay for after people left.
Pricing
Fixed in writing before any work starts, from a 30-minute call. The price depends on the rows below.
- Lifecycle audit
- A fixed fee, set on the call, for one week of work.
- Build
- One joiner and leaver chain on your systems.
- What changes the price
- The HR system, the number of apps in the chain and whether you run Microsoft 365, Google Workspace or both.
- After the handover
- Operate, for flow maintenance. Ten hours a month for changes, reviews and questions on what I built or reviewed. Unused hours do not roll over. No response time is promised. No minimum term, 30 days' notice on either side, invoiced monthly in advance.
- Currency
- EUR, excluding VAT.
- VAT
- Reverse charge for EU businesses outside Malta whose VAT number validates in VIES. Malta VAT otherwise.
- Invoiced by
- Michal Jatczak, sole trader registered in Malta.
- Service level
- No SLA and no on-call duty. Dates are written into the Statement of Work.
Questions
The clauses the run log answers
ISO 27001:2022, A.5.18
Access rights provisioned, reviewed and removed on role change and exit. The run log is the record a reviewer asks for.
NIS2, Article 21(2)(i)
Human resources security and access control for essential and important entities. Leaver handling sits inside it.
GDPR, Article 32
A former employee with live access to personal data is a security-of-processing failure. Revocation on the HR trigger closes the window.
We are a 30-person company with no IT department. Is this for us?
Yes. I wire the joiner and leaver chains into the HR flow you already have and hand them over with runbooks. If you want help after that, the Operate retainer covers flow maintenance by the hour. Work runs in business hours, with no response time promised.
Is the leaver chain already running somewhere?
Not at a client yet. It is a design I build per client, in your own tenant, and the first run happens on your test accounts before any real leaver goes through it.
What happens when someone leaves?
When the HR trigger fires, sessions and refresh tokens are revoked, sign-in is blocked, the mailbox becomes shared, OneDrive is archived, app seats are removed and the licence returns to the pool. Executive accounts wait for a manual approval first. Every step is written to a log you own. Timing follows the HR trigger and is not a service level.
Which HR systems can trigger the flows?
Personio, BambooHR and HiBob are the common cases. Anything that can fire a webhook or send a structured email works, including an HR mailbox with a defined subject format.
Can you do this on Google Workspace too?
Yes, the chains work on Google Workspace or on both platforms at once. Microsoft licences can come through Pax8; Google Workspace stays billed direct.
Do you also supply the laptops?
No. Devices are not part of this engagement. Enrolling and managing them is the device baseline, a separate fixed engagement.
Why keep our own run log?
An auditor asks for the execution log, not the procedure document. Power Automate keeps its own run history for 28 days by default, so every run also writes to a log you own and keep as long as you need.
Does the automation lock us into me?
No. The flows run inside your tenant, the runbooks live in your repository, and the Exit Kit documents the whole build. It is delivered within 24 hours of the engagement closing under a Statement of Work.
Close the leaver window before the next audit asks about it.
A 30-minute call sets the scope. The audit starts with a read-only check.
Every consulting engagement ends with an Exit Kit.