Right access on day one, every account closed on the last day
A done-for-you onboarding and offboarding access automation is an AI agent that watches your HRIS for joiners, movers and leavers and acts in your identity and SaaS tools. It creates accounts and groups by role, requests approval for anything extra, adjusts access when someone changes team, and on departure disables sign-in, revokes sessions, transfers files and removes licences across every app. BufferSol builds it around Entra ID or Okta and logs each step as audit evidence.
- Live in 3 to 6 weeks
- Works with Microsoft Entra ID, Okta and more
- People approve what matters
Is this you?
Companies with a hundred to a few thousand staff, many SaaS apps and regular hiring and turnover, where IT or an MSP handles joiner, mover and leaver changes by hand from HR emails.
- IT learns about a departure after the person has already left.
- Nobody can list every app a leaver had an account in.
- People who changed teams still have access from their old role.
- Auditors ask for proof of timely deprovisioning and you assemble it from tickets.
- You pay for SaaS licences assigned to people who no longer work for you.
Today vs done for you
The current way, and the new way
What your team does by hand today, and what the automation does instead, step by step.
How it works today
- HR emails IT that someone is starting, moving or leaving, sometimes on the day.
- A technician copies a similar user's groups in Active Directory or Entra ID and hopes they fit.
- App owners are asked one by one to add or remove the person in Salesforce, GitHub, NetSuite and other tools.
- For leavers, the account is disabled, but shared drives, mail forwarding and app accounts outside SSO are forgotten.
- Movers keep old access because nobody asks for it to be removed.
- At audit time, IT pulls ticket histories together to prove what happened.
What it quietly costs you
- · Former staff and contractors keep working credentials, a direct security and data risk.
- · Licence spend on accounts nobody uses.
- · Weeks of manual effort before each SOC 2, ISO 27001 or customer security review.
How it works done for you
- The agent watches Workday, BambooHR, HiBob or Rippling for hires, job changes, leave and terminations, and reads role, department, location and manager.
- For a joiner, it creates the identity in Entra ID or Okta, adds the role's standard groups and apps, and sends any extra access to the manager and app owner for approval.
- For a mover, it compares old and new role bundles, adds what the new role needs, and queues removal of old access for the manager to confirm.
- For a leaver, at the time HR sets, it disables sign-in, revokes sessions and tokens, removes MFA devices, transfers mailbox and drive ownership, and removes licences.
- It then works through apps outside SSO from your app inventory, removing accounts by API or opening a task for the app owner where there is no API.
- Each step is written to the ticket and an audit log. Anything that fails is escalated to IT the same day, and a monthly report lists any account without an active owner.
Your people
What changes for your team
| Role | Today | Done for you |
|---|---|---|
| IT administrator | Copies group memberships by hand and chases app owners for every joiner and leaver. | Approves exceptions, reviews failed steps and maintains role bundles. |
| Security and compliance lead | Rebuilds access history from tickets and spreadsheets before every audit. | Exports a complete log of grants, removals and approvals in minutes. |
| HR partner | Emails IT about every change and gets asked the same questions back. | Updates the HRIS once and sees access status for each change. |
The numbers
What it's worth to you
Estimate the time and cost you get back with your own numbers. We baseline the real figures in week 1 and track these KPIs from day one.
Example inputs · change them to yours
The automated share covers account creation, group changes, session revocation and app removals that have an API; approvals and apps without APIs stay with people.
Staff time back
50 hours a month
About 0.3 full-time people freed for higher-value work
Capacity reclaimed a month
$2,228
A year
$26,730
An estimate from your inputs only. In week 1 we measure your real baseline, so results are tracked against your own numbers.
Time to deprovision
Minutes from the HR termination time to sign-in disabled, and hours to last app account removed.
Day-one access completeness
Share of joiners with all role-standard access working at start time.
Orphaned accounts
Accounts in connected apps with no matching active employee, counted monthly.
Unused licences reclaimed
Licences removed from leavers and inactive users each month.
Audit evidence time
Hours spent preparing access evidence for an audit, before and after launch.
83%
35%
Works with the tools you already use
- Microsoft Entra ID
- Okta
- Google Workspace
- Microsoft 365
- Workday
- BambooHR
- Rippling
- Salesforce
- GitHub
- Slack
Guardrails built in
- The HRIS is the trigger; the agent never creates or removes access based on a chat message alone.
- Access outside the role bundle, and any admin role, needs named approvals from the manager and app owner.
- Terminations follow the timing HR sets, with a hold option for legal or investigation cases.
- Mailboxes and files are transferred or retained under your retention policy, never deleted on day one.
- Every change is logged with who requested it, who approved it and when it ran, ready for SOC 2 and ISO 27001 evidence.
Why it hurts today
What teams say about this work
Common complaints from operators, reviewers and industry research.
Most former employees in a multi-country study admitted they still had access to accounts from a previous employer after leaving.
Exit processes are inconsistent: they are run by supervisors, HR or even a coworker, and basic steps such as deleting or resetting accounts are often skipped.
Many former staff say they could still log in with old credentials because the passwords were never changed after they left.
Software and access approvals sit unnoticed in someone's inbox, and with no tracked deadlines small delays turn into new hires who can't sign in on day one.
Done for you
Live in 3 to 6 weeks
We do the build, the integrations and the rollout. Your team gives us access, reviews the pilot and approves go-live.
- 1
Week 1
Discovery and access
We map the workflow with your team, agree the outcomes and KPIs, measure today's baseline and get secure access to your tools.
- 2
Weeks 2–3
Build and connect
We build the agents and connect your systems, with your rules, approval steps, permissions and logging.
- 3
Weeks 3–5
Test and pilot
We test on your real history, then run a pilot on live work while your team reviews what the agent does.
- 4
Weeks 4–6
Go live and hand over
We roll out in stages, train your team, hand over dashboards and runbooks, and keep improving it with you.
Executive Ask: ask your business anything
One plain-English assistant connected to every system you run: CRM, helpdesk, ERP and accounting, HR, inbox and docs. Leaders get sourced answers in seconds and can trigger actions with approval. It respects everyone's existing permissions and logs every answer.
See Executive AskAsk it, for example
- Does anyone who left in the last ninety days still have an active account anywhere?
- How many SaaS licences are assigned to people who no longer work here?
- Which access requests are waiting on approval for people starting next week?
Employee Onboarding & Offboarding Access: questions
Straight answers to what clients ask us most.
Ask our teamWhat about apps that aren't connected to SSO?
We build an app inventory with you during setup. For apps with an API, the agent removes or adds accounts directly. For apps without one, it opens a task for the named app owner with a deadline, follows up, and records when it was done. The monthly orphaned-account report checks connected apps against the HRIS so gaps show up quickly.
Can we hold a departure for legal or investigation reasons?
Yes. HR or legal can set a hold on a leaver in the HRIS or through an approval step. The agent then disables sign-in as scheduled but keeps mailboxes, files and devices preserved, and skips any transfer or deletion until the hold is lifted. Every hold, and who placed it, is logged.
How long does it take to go live?
Most clients are live in 3 to 6 weeks. We map role bundles with IT and department heads, build the app inventory, and connect the HRIS and identity provider with least-privilege accounts. Leavers usually go first because they carry the most risk, then joiners and movers, each tested in suggest-only mode before the agent acts on its own.
What does it cost?
Pricing is quoted after a short scoping call. It depends on headcount, how many apps you want covered, how many have usable APIs, and whether you need audit evidence packs for SOC 2 or ISO 27001. You get a written fixed-scope quote before work begins, and nothing is billed beyond what that quote covers.
Does this work for an MSP managing many clients?
Yes. We can build it per client tenant, with each client's HRIS or a simple request form as the trigger, and separate role bundles, approvers and logs for each. Technicians see joiner and leaver tasks in ConnectWise or Autotask, and each client gets its own evidence report for its auditors.
Pairs well with
HR & Recruiting
Employee Onboarding
New hires signed, equipped and logged in before their first morning
See the outcomeIT & Internal Ops
IT Helpdesk Automation
Password resets, lockouts and how-to tickets closed in minutes, not left in the queue
See the outcomeLegal & Compliance
Compliance Monitoring & Evidence Collection
Audit evidence gathered, checked and filed all year, not in a panic before fieldwork
See the outcomeSources
- 83% of employees continue accessing old employer’s accounts, Help Net Security
- Poor Offboarding Leaves Organizations Open to Threats, Security Boulevard
- Almost half of former employees say their passwords still work, Dark Reading
- New Hire Checklist: Laptops, Access and Accounts Without the Email Chaos, Desk365
Get Employee Onboarding & Offboarding Access done for you
Tell us about your volumes and tools. A senior engineer replies within one business day with scope, timeline and cost.
Live in 3 to 6 weeks · Priced after a short call · Company emails only