They left in March.
You are still paying for them.
The identity provider disabled the account on day one. The Figma seat, the Notion seat, the OAuth grant with read access to the company drive and the SAP named user are all still live. CerteroX closes each one and keeps the receipt.
Answered on one platform. One data model across ITAM, SAM, SaaS, Cloud and AI.
Offboarding checklist
IllustrativeLeaver · 118 days since last working day
Per-licence revocation status, per connector
- Entra ID account disabled by the joiner-mover-leaver process
- closed · day 1
- Microsoft 365 E5 reclaimed to the pool
- closed · day 1
- Figma no connector action ever requested
- still assigned
- Notion deprovision queued
- in progress
- OAuth grant · drive read granted 2 years ago, dormant 118 days
- active · risk 78
Wasted spend, this user
still accruing monthly
The problem
Disabling the account is step one of about twenty.
Nobody argues with that. The problem is that steps two through twenty live in twenty different admin consoles, and no single system knows the list is incomplete.
46%
of SaaS licences go unused — the average organisation uses 54%
Departed users are the easiest slice of that to recover, because nobody is going to object.
- 01 sign-in blocked, seat live
The seat survives the account.
Blocking sign-in stops access. It does not release the seat, and most vendors keep billing for an assigned licence regardless of whether anyone can reach it. The saving needs an action at the vendor, through the connector that holds that vendor’s own user list.
Connector sync pulling authoritative user and licence lists from the vendor SaaS Management
- 02 the grant outlives the account
A third-party app still has read access, and its consent came from a mailbox that no longer exists.
An OAuth grant outlives the session that created it. Dormancy is exactly the condition under which nobody notices, and exactly the condition that makes the grant worth reviewing.
OAuth grant risk scoring on sensitivity, scope, consent and dormancy SaaS Management
- 03 every vendor is different
One of your vendors has no suspend API at all.
HubSpot cannot suspend, so you either strip roles or delete. Box has to transfer file ownership before deactivating or the files go with the user. ServiceNow needs the account locked and every role and group membership stripped. A generic “disable user” call does none of this.
Provisioning and deprovisioning across Entra, Okta, Google, M365 and more SaaS Management
- 04 nobody can prove it finished
A closed ticket is the only evidence anybody has.
Ask which licences that leaver held on their last day and what happened to each one. If the answer is a closed ticket, the gap is open and you cannot see how wide.
Offboarding checklist per user with per-licence revocation status SaaS Management
- An offboarding process you cannot audit is a billing arrangement with your former employees and a standing invitation to whoever holds their credentials.
Three of the five disciplines.
Each runs standalone and shares one asset model, so the parts of this that span products need no integration work.
- Primary CerteroX SaaS Management Per-licence revocation, vendor-specific deprovisioning and the workflow engine that drives it. Product page
- Also applies CerteroX ITAM The device, the mobile enrolment and the directory objects that go with the person. Product page
- Also applies CerteroX SAM Named users and per-device entitlement released back into the licence position. Product page
From the leaver record to an empty list.
A closed loop keeps its own record of what it has not finished yet.
-
Trigger from the source of truth
Leaver status comes from the identity provider, on the day the account is disabled.
- Identity provider sync from Entra ID and Okta including MFA enrolment SaaS Management
- Workflow engine: 8 triggers, 11 conditions, 13 actions on one canvas SaaS Management
- Active Directory import of users, groups, computers, sites and subnets ITAM
-
Enumerate everything they held
What the vendors say they hold, read back connector by connector.
- Connector sync pulling authoritative user and licence lists from the vendor SaaS Management
- OAuth grant discovery for consented third-party applications SaaS Management
- Offboarding checklist per user with per-licence revocation status SaaS Management
- Mobile device management for iOS and Android, including Apple DEP ITAM
-
Revoke the way each vendor requires
Thirteen workflow actions, and connectors that know the difference between suspend, strip and delete.
- Provisioning and deprovisioning across Entra, Okta, Google, M365 and more SaaS Management
- Actions: reclaim, reassign, downgrade tier, archive, remind, dismiss SaaS Management
- One-click grant revocation, also available as a workflow action SaaS Management
- Bulk deprovision wizard for multi-select offboarding SaaS Management
-
Prove it closed, and price what has not
An open item with a monthly cost against it gets finished. An open item on a checklist does not.
- Wasted spend metric for licences still held by departed users SaaS Management
- Audit log covering every provisioning and deprovisioning step SaaS Management
- Six-tier role model including a dedicated Auditor role SaaS Management
- Realized savings, realized avoidance and ROI by fiscal quarter SaaS Management
Ask to see any one of these running in the product itself, on the screen where it happens.
What good looks like.
You can measure offboarding maturity with one question: what is it costing you right now?
- 01
You can answer the question for any leaver.
Every licence they held, the connector status behind each one, and whether revocation is pending, in progress or complete. On one screen, for anyone who has ever left.
- 02
Open items have a price.
The wasted spend metric puts an estimated monthly cost against licences still held by departed users. A number moves faster through a service desk than a reminder does.
- 03
Deprovisioning respects each vendor’s reality.
Soft mode where there is no suspend API, file-ownership transfer before deactivation where files would otherwise be lost, role and group stripping where an account cannot simply be removed.
- 04
Grants are revoked inside the leaver workflow.
One-click revocation for consented third-party applications, and the same revocation available as an automated action inside the leaver workflow.
- 05
An auditor can check it without you.
A dedicated Auditor role in a six-tier model, with an audit log covering every provisioning and deprovisioning step. Evidence you do not have to assemble.
Questions worth asking us.
Not the one you came with? Ask it directly and we will answer it in writing.
Our identity provider already deprovisions on termination. Is that not enough?
It is enough for access and not for cost, and it only reaches applications behind SSO. Anything bought outside identity, which is most shadow IT, keeps its seat and its bill. Connector sync reads the authoritative user list from the vendor, which is the only place that knows the licence is still assigned.
How does it handle applications with no deprovisioning API?
The connector handles it explicitly. Where a vendor has no suspend capability the connector offers a soft mode that strips roles and a hard mode that deletes, and the checklist shows which one ran. Where a vendor needs a sequence, such as transferring file ownership before deactivating, the connector performs the sequence.
Can it run without a human in the loop?
It can, and for most of the list it should. The workflow engine has 8 triggers, 11 conditions and 13 actions on one canvas, so low-risk revocations run automatically and anything touching data ownership or a shared mailbox routes to a person first.
What about the laptop, the phone and the licences on them?
Same platform. The device record, the mobile enrolment including Apple DEP, and the software installed on it all sit on the same asset model, so a leaver releases device-assigned entitlement back into the licence position on the day they go.
We have thousands of historic leavers. Where do we start?
With the bulk deprovision wizard and a sort by wasted spend. The multi-select wizard handles the backlog in batches, highest cost first, and realized savings are then tracked by fiscal quarter so the clean-up has a figure attached to it.
Open a leaver from last year.
See what they still hold.
The offboarding checklist walked end to end: every licence still assigned after the account was disabled, revocation pending or complete, and a monthly cost on every line. Name the vendors your leavers hold onto and we build the session on those.
It takes one session and nothing to connect, with someone technical on the call for you to press.