# Employee Onboarding & Offboarding Access: done-for-you AI automation by BufferSol

> A done-for-you onboarding and offboarding access automation is an AI agent that watches your HRIS for joiners, movers and leavers and acts in your identity and SaaS tools. It creates accounts and groups by role, requests approval for anything extra, adjusts access when someone changes team, and on departure disables sign-in, revokes sessions, transfers files and removes licences across every app. BufferSol builds it around Entra ID or Okta and logs each step as audit evidence.

- Canonical: https://buffersoltech.com/done-for-you/automations/access-provisioning
- Industries: SaaS & Technology (MSPs & IT services)
- Provider: BufferSol Technologies (New York; serving the US, UK, Ireland, Canada and the EU)
- Timeline: live in 3 to 6 weeks
- Pricing: quoted after a short scoping call

## Right access on day one, every account closed on the last day

**Who it is for:** Companies with a hundred to a few thousand staff, many SaaS apps and regular hiring and turnover, where IT or an MSP handles joiner, mover and leaver changes by hand from HR emails.

### Signs you need it
- IT learns about a departure after the person has already left.
- Nobody can list every app a leaver had an account in.
- People who changed teams still have access from their old role.
- Auditors ask for proof of timely deprovisioning and you assemble it from tickets.
- You pay for SaaS licences assigned to people who no longer work for you.

## Business outcomes
- **Departures closed the same day.** When HR records a termination, sign-in is disabled and sessions revoked at the agreed time, and every connected app is cleaned up from one checklist.
- **Access that matches the role.** New hires and movers get the groups and apps their role needs, extras need an approval, and old access is removed when people change jobs.
- **Evidence on demand.** Every grant and removal is logged with the approver and time, so access reviews and audits take hours of checking instead of weeks of hunting.

## How it works today
1. HR emails IT that someone is starting, moving or leaving, sometimes on the day.
2. A technician copies a similar user's groups in Active Directory or Entra ID and hopes they fit.
3. App owners are asked one by one to add or remove the person in Salesforce, GitHub, NetSuite and other tools.
4. For leavers, the account is disabled, but shared drives, mail forwarding and app accounts outside SSO are forgotten.
5. Movers keep old access because nobody asks for it to be removed.
6. At audit time, IT pulls ticket histories together to prove what happened.

Hidden costs:
- Former staff and contractors keep working credentials, a direct security and data risk.
- Licence spend on accounts nobody uses.
- Weeks of manual effort before each SOC 2, ISO 27001 or customer security review.

## How it works done for you
1. The agent watches Workday, BambooHR, HiBob or Rippling for hires, job changes, leave and terminations, and reads role, department, location and manager.
2. For a joiner, it creates the identity in Entra ID or Okta, adds the role's standard groups and apps, and sends any extra access to the manager and app owner for approval.
3. For a mover, it compares old and new role bundles, adds what the new role needs, and queues removal of old access for the manager to confirm.
4. For a leaver, at the time HR sets, it disables sign-in, revokes sessions and tokens, removes MFA devices, transfers mailbox and drive ownership, and removes licences.
5. It then works through apps outside SSO from your app inventory, removing accounts by API or opening a task for the app owner where there is no API.
6. Each step is written to the ticket and an audit log. Anything that fails is escalated to IT the same day, and a monthly report lists any account without an active owner.

## What changes for the team
- **IT administrator.** Today: Copies group memberships by hand and chases app owners for every joiner and leaver. Done for you: Approves exceptions, reviews failed steps and maintains role bundles.
- **Security and compliance lead.** Today: Rebuilds access history from tickets and spreadsheets before every audit. Done for you: Exports a complete log of grants, removals and approvals in minutes.
- **HR partner.** Today: Emails IT about every change and gets asked the same questions back. Done for you: Updates the HRIS once and sees access status for each change.

## KPIs we measure
- **Time to deprovision:** Minutes from the HR termination time to sign-in disabled, and hours to last app account removed.
- **Day-one access completeness:** Share of joiners with all role-standard access working at start time.
- **Orphaned accounts:** Accounts in connected apps with no matching active employee, counted monthly.
- **Unused licences reclaimed:** Licences removed from leavers and inactive users each month.
- **Audit evidence time:** Hours spent preparing access evidence for an audit, before and after launch.

## Industry data
- 83%: of employees admitted to maintaining continued access to accounts from a previous employer (Beyond Identity study, 2022) ([Help Net Security](https://www.helpnetsecurity.com/2022/02/21/employees-maintaining-accounts-access/))
- 35%: of departing employees had their accounts deleted or reset as part of the exit process (Beyond Identity survey, 2022) ([Security Boulevard](https://securityboulevard.com/2022/02/poor-offboarding-leaves-organizations-open-to-threats/))

## Systems it connects to
Microsoft Entra ID, Okta, Google Workspace, Microsoft 365, Workday, BambooHR, Rippling, Salesforce, GitHub, Slack

## Guardrails
- The HRIS is the trigger; the agent never creates or removes access based on a chat message alone.
- Access outside the role bundle, and any admin role, needs named approvals from the manager and app owner.
- Terminations follow the timing HR sets, with a hold option for legal or investigation cases.
- Mailboxes and files are transferred or retained under your retention policy, never deleted on day one.
- Every change is logged with who requested it, who approved it and when it ran, ready for SOC 2 and ISO 27001 evidence.

## What teams say about this work
- Most former employees in a multi-country study admitted they still had access to accounts from a previous employer after leaving. ([Help Net Security](https://www.helpnetsecurity.com/2022/02/21/employees-maintaining-accounts-access/))
- Exit processes are inconsistent: they are run by supervisors, HR or even a coworker, and basic steps such as deleting or resetting accounts are often skipped. ([Security Boulevard](https://securityboulevard.com/2022/02/poor-offboarding-leaves-organizations-open-to-threats/))
- Many former staff say they could still log in with old credentials because the passwords were never changed after they left. ([Dark Reading](https://www.darkreading.com/threat-intelligence/almost-half-of-former-employees-say-their-passwords-still-work))
- Software and access approvals sit unnoticed in someone's inbox, and with no tracked deadlines small delays turn into new hires who can't sign in on day one. ([Desk365](https://www.desk365.io/blog/new-hire-checklist/))

## Delivery: live in 3 to 6 weeks
1. Week 1: discovery, access and a baseline of today's numbers.
2. Weeks 2–3: build the agents and connect your systems, with your rules and approvals.
3. Weeks 3–5: test on your real history, then pilot on live work with your team reviewing.
4. Weeks 4–6: staged go-live, training, dashboards and handover.

## Executive Ask questions for this workflow
- Does anyone who left in the last ninety days still have an active account anywhere?
- How many SaaS licences are assigned to people who no longer work here?
- Which access requests are waiting on approval for people starting next week?

## Frequently asked questions
### What about apps that aren't connected to SSO?
We build an app inventory with you during setup. For apps with an API, the agent removes or adds accounts directly. For apps without one, it opens a task for the named app owner with a deadline, follows up, and records when it was done. The monthly orphaned-account report checks connected apps against the HRIS so gaps show up quickly.

### Can we hold a departure for legal or investigation reasons?
Yes. HR or legal can set a hold on a leaver in the HRIS or through an approval step. The agent then disables sign-in as scheduled but keeps mailboxes, files and devices preserved, and skips any transfer or deletion until the hold is lifted. Every hold, and who placed it, is logged.

### How long does it take to go live?
Most clients are live in 3 to 6 weeks. We map role bundles with IT and department heads, build the app inventory, and connect the HRIS and identity provider with least-privilege accounts. Leavers usually go first because they carry the most risk, then joiners and movers, each tested in suggest-only mode before the agent acts on its own.

### What does it cost?
Pricing is quoted after a short scoping call. It depends on headcount, how many apps you want covered, how many have usable APIs, and whether you need audit evidence packs for SOC 2 or ISO 27001. You get a written fixed-scope quote before work begins, and nothing is billed beyond what that quote covers.

### Does this work for an MSP managing many clients?
Yes. We can build it per client tenant, with each client's HRIS or a simple request form as the trigger, and separate role bundles, approvers and logs for each. Technicians see joiner and leaver tasks in ConnectWise or Autotask, and each client gets its own evidence report for its auditors.