What to Look for in Employee Offboarding Software in 2026

It's 4 p.m. on a Friday, and HR marks an account manager as terminated. Soon after, your identity provider, the tool that runs single sign-on, turns off her main login. But her chat app is still open on her phone, and an analytics tool with its own password still lets her in. On Monday morning, a report script she linked to her account with a personal access key runs again.

Each of those is a door that stays open until someone closes it. Employee offboarding software closes them. It starts from the HR record, shuts off a departing employee's access to every app, account, and key they had, and keeps a record of each step.

Turning off the main login is the easy part, and your identity provider already does it. The software earns its price on what comes next: apps that skip single sign-on, accounts HR doesn't know about, and proof that each one is closed.

Final paychecks, exit interviews, and laptop returns belong to your HR and IT asset tools, but the doors left open that Friday don’t. Closing them is what your team should look for in employee offboarding software. The features that follow run from the HR trigger that starts offboarding to the access reviews that catch what it missed.

Access revocation inside every app a leaver used

Look for access revocation inside every app a leaver used, because that's the job employee offboarding software exists to do. Revoking access means the account inside each app is closed or deactivated, its groups and entitlements are gone, and its license is back in the pool. A disabled single sign-on login doesn't do that, and neither does a ticket marked done.

Plenty of products sold as offboarding software never reach that far. HR exit platforms run the paperwork, and an HRIS offboarding module can mark "remove access" complete the moment someone ticks a box, with no app touched. IT asset tools get laptops and phones back and wiped, which leaves every account the person used on them open. Some HR suites now bundle app deprovisioning, so ask what that module does inside each app before you count it.

Access revocation software, often sold as IT offboarding software, closes the account in each app, strips its entitlements, reclaims the license, and records each step. Offboarding tools that only assign tasks, with no connector behind them and no check that the task got done, leave the hard part with the person who was already too busy to do it. Judge each tool by what it does to accounts inside your apps, whatever category it's sold in.

If your HRIS already handles the paperwork and your laptops come back, your gap is access revocation, and every feature below is a test of it. Offboarding is one stage of your workforce identity and access management program, and it's the stage where a gap turns into a former employee with a live login.

HRIS-triggered offboarding with scheduled and immediate timing

HRIS-triggered offboarding should start without a ticket, run at the moment you choose, and stay silent until HR has had the conversation. We treat every HRIS event as an access event, so the termination entry that reaches your HRIS integration should start the leaver workflow on its own. A tool that only emails IT puts a person back in the loop, and that person is the delay. If your team still opens a ticket for every departure, wiring that trigger is the first step to automate employee offboarding.

Timing comes in two modes. Planned departures run at a set time, usually the end of the last day. Involuntary terminations run immediately, often while the meeting is still going, and the person leaving shouldn't get an automated notice before the conversation happens. Settle that order of offboarding communication with HR before the tool goes live.

If cardholder data is in scope, the window is already set, since PCI DSS Requirement 8.2.5 says "Access for terminated users is immediately revoked." Everywhere else, the window is a policy you write. Whatever you write, the software has to honor it on every app it touches.

Two edge cases break the simple version of that trigger. Contractors and other people who aren't in your HRIS need a second way in, such as a contractor list with end dates or a manual offboarding a manager can start. Once the HR feed drives removal, a bad sync becomes a risk of its own, because an HRIS export that comes back empty could offboard the whole company. The software needs a brake that stops a sync like that before it writes anything.

Lumos Lifecycle Management starts the leaver workflow from the offboarding event in your HRIS. For a contractor or anyone else the HRIS doesn't hold, admins can start a manual offboarding. Your team can see which removal method will run for each account and override it account by account, and Lumos doesn't notify the employee about lifecycle changes. Its four Sync Circuit Breakers, on by default for every connected app, halt a sync that would terminate half your active identities or return no accounts.

The pilot later in this guide tests the trigger on every vendor. Run its involuntary termination through a sandbox HRIS and let offboarding automation do the rest. The first closed account shows how fast the trigger fires, and the test employee's inbox shows whether the tool or any app sent a notice too early.

User deprovisioning for apps outside SSO

User deprovisioning has to reach the apps outside single sign-on, because disabling the SSO login blocks new sign-ins to the apps behind it and does nothing to the logins that never went through it. Access in those logins survives the disable untouched.

An IT professional at a Hawaii financial company left his job in 2019. Shortly after, he signed in to the account the company used to manage its internet domain, using the company's own credentials, and pointed its website and email traffic at computers it didn't control. He kept the company locked out for several days as part of a scheme to pressure it into rehiring him at a higher salary, and he pleaded guilty in 2022.

That login belonged to the company, so nothing tied to his own accounts could have closed it. Rotating the credentials he knew was the step that would have. Here's where a departing employee's access lives, and what to ask vendors about it.

‍

Removal at the app level, the second row, is where many tools stop. What a former employee can still use after the disable sits in the first row's open sessions and in the third and fourth rows. The fourth keeps growing, because people connect AI assistants and agents to their work accounts and no HR record lists any of them.

Some of what a leaver leaves behind needs a new owner on the last day. Service accounts, integrations, and agents the person set up keep work running, and revoking them breaks whatever depends on them. An automated non-human identity lifecycle hands each one to a named owner the same day the person's own accounts close.

Lumos's leaver workflow revokes access across identity providers, local accounts, custom apps, SaaS, cloud, and on-premises apps from one event, through more than 300 integrations, and logs each change. Marqeta automated its onboarding and offboarding across more than 150 apps within its first two months on Lumos. The fourth row is the one to press every vendor on in the pilot, us included.

Some removals will always need a person, and what the software does with them is the real test. Prema Nagarajan, our Director of IT, runs offboarding at Lumos on Lumos. Lumos builds each leaver's task list from the access that person holds that day, app owners get an automatic task to revoke it, and IT follows up when one stalls. Before that, her team tracked each person's apps by hand and chased owners through tickets and email.

Sort your top 50 apps into the four rows before any vendor call, since that list sets what your pilot has to cover. When the pilot runs, check rows three and four on every test user. Check again the next morning, because a session that survived the disable shows up then.

Orphaned account detection matched against your HRIS

Orphaned account detection checks the accounts in your apps against your HRIS and surfaces orphaned accounts, the ones no HR record points to. Offboarding that starts from a person's name will never close one the person created under a different name.

A former employee of a medical device packaging company built his back door while he still worked there. He created a fake user account in the platform that held the company's shipping records. After he was terminated in early March 2020, he used it to sign in three days after his final paycheck. He then created a second fake account, edited about 115,581 records, and deleted about 2,371, delaying shipments of protective equipment to healthcare providers.

When he was done, he deactivated both accounts and logged out. He was sentenced to a year and a day in federal prison in October 2020 and ordered to pay $221,200 in restitution.

Nothing keyed to his name would have reached those accounts, so the software has to work from the accounts themselves. It should match every account in a connected app to a person in your HRIS and put the accounts that match no one in a queue with an owner. It should also flag accounts nobody has used in months. A back door like his gets built while the person still has admin rights, so the pilot's admin test checks for accounts created in the weeks before the departure.

Lumos Identity Analytics flags accounts with no owner and accounts holding more access than their owner needs. The ownerless ones are exactly what a name-based offboarding walks past, and each dormant account it surfaces comes with a way to fix it attached.

Before the pilot, match the accounts in a few of your top 50 apps against the HRIS. The unmatched list is what each vendor's tool should find on its own.

Automated deprovisioning with confirmation from each app

Automated deprovisioning needs confirmation from each app, account by account, because removals fail quietly. A connector's credentials expire, an API call hits a rate limit, an app accepts the request and ignores it, or an app owner closes a task without acting.

A dashboard that marks the job complete because it sent a request is reporting intent. Treating intent as done is one reason teams hold back on automating removal at all.

Lumos's 2026 survey asked 133 technology and security leaders at North American companies with 500 or more employees what holds back automation. Of those who answered, 47.1% named distrust of automated results and 41.2% named insufficient auditability. For offboarding, both point to the same fix, which is a removal you can check.

So ask for four things. The software should read status back from the app after every change and turn each failed removal into a task with an owner and a retry. It should also capture the owner's confirmation and evidence for every manual step. And it should keep a record of each removal an auditor can sample when testing terminated users for SOX, SOC 2, or PCI DSS.

In Lumos, offboarding runs on the same workflow model as every other access change, so a failed removal comes back as an error task with a retry. You can hand an auditor a step-level record for any removal.

Test the auditor record during the pilot. For one removal, have each vendor show the record it would hand your auditor, including the app's own confirmation and a timestamp to line up against the HR termination. That pair of timestamps is what shows your IT offboarding process met its own deadline.

User access reviews that auto-revoke what offboarding missed

User access reviews should find what offboarding missed and auto-revoke it once a reviewer rejects it, because offboarding only closes the access it knows about. A review works the other way, starting from the accounts in each app instead of the HR record. That's how it finds a mover's leftovers, a contractor outside the HRIS, or an account no HR record points to.

A review only helps offboarding if it does three things. It should flag access still held by someone HR has already terminated, so the reviewer sees the miss first. A rejected item should end in a removal the software carries out and confirms, because a review that ends in a spreadsheet moves the gap to whoever reads it. And each cycle should show what changed since the last one, so reviewers spend their time on new access and recent departures.

Lumos user access review software revokes rejected access automatically, and each removal runs through the same workflow as an offboarding. Albus, our AI agent, recommends accepting or rejecting each account and labels the reason with an insight such as Terminated or Inactive. At ChargePoint, the team removes access with one click and Lumos handles the deprovisioning, while one button builds the reports for frameworks such as SOC 2, SOX, and FedRAMP.

Treat every former employee a review turns up as a miss in offboarding, and trace it back to the step that skipped it. When reviews stop finding former employees, your offboarding is closing what it should.

Just-in-time access with automatic expiration

Just-in-time access with automatic expiration leaves less to offboard, because the easiest access to remove is access that has already ended. An end date on every grant is one of the employee offboarding best practices that shrink a departure before it happens. Time-bound grants to sensitive apps end on their own, and movers should lose their old team's access on the transfer date.

Before Lumos, Code42 granted permanent access to sensitive apps. It moved its most critical apps to time-based access, so on-call engineers now get break-glass access in seconds and Lumos removes it within a few hours. Privileged access across its stack fell 67%.

Whatever's left on someone's last day is what offboarding has to find. The pilot's mover test checks this, since someone who changed teams should reach their last day with none of the old team's access.

SaaS license management tied to every departure

SaaS license management belongs on the same event that closes a leaver's access, because every departure frees paid seats. Order matters here. Some apps keep billing for a suspended user, and some delete a user's files after the license is removed. So suspend access first, move files and mailboxes to the manager, then reclaim the seat.

Software that only removes access leaves the seat billing, and software that reclaims the seat before the transfer deletes work you needed. Departures aren't the only idle seats, either, and the same last-used data that confirms a leaver is gone also finds people who stopped opening an app months ago.

Lumos shows Checkr when each employee last used an app, so when someone goes 90 days without opening a tool like its whiteboard or video meeting app, an automated workflow can reclaim the license. Time-based access and inactivity workflows together helped Checkr cut $230,000 in software costs.

On your top 50 list, count the paid seats still assigned to people who left in the last 90 days, and multiply each by its price. That total is what your current offboarding is costing you.

Proof-of-concept testing with your hardest leavers

Proof-of-concept testing with your hardest leavers shows what a vendor's demo usually skips, since a demo runs the easy case. Rebuild five recent departures as test users and put each one through every tool on your shortlist. Give each test user the apps, roles, and local accounts the real person had, and swap in your own hardest cases if they look different from the five below. Pick them by role, since how to offboard an employee depends on what that person's job gave them.

‍

Score each tool on time to last confirmed removal. Measure it from the termination entry in your HRIS, or the moment someone starts a contractor's offboarding, to the moment the last app confirms. Until then, a former employee can still sign in somewhere.

Track three counts alongside it. They're the share of removals the app itself confirmed, the manual tasks still open after 24 hours, and the accounts the tool found that your HRIS didn't know about. Last, break one connector on purpose by revoking its credentials, and see whether the failed removal shows up as an open task within a day.

Pull the real leavers' HRIS timestamps too, so you can compare each tool against what your current process took. Check each tool's results against an employee offboarding checklist that covers every step for one departure, so a skipped step counts as a miss.

Send the table to each vendor before the pilot starts, so every one of them has to run your hard cases. A vendor that won't is telling you which leaver it can't handle.

Offboarding software that scales with every new app and grant

Offboarding software has to scale with every new app and grant, because the leaver you offboard next year will hold more than the one you're testing with today. Expect more apps, more grants, and more accounts no HR record lists, and buy for that leaver.

Run the five-leaver pilot this quarter, while the departures you rebuild are still fresh. The tool worth buying is the one whose slowest app still closes on time, with a record to prove it and a review that catches whatever slipped past.

Lumos Lifecycle Management starts the leaver workflow from your HRIS and closes access in every connected app from that one event. Removals that need a person become tasks for app owners, and failed ones come back for a retry, with a record for your auditors. Lumos access reviews then revoke whatever offboarding missed once a reviewer rejects it. Book a demo and bring your hardest leaver from last quarter.

‍

‍