Offboarding
Removing someone revokes their access to the workspace everywhere, in one step:
- their workspace and team memberships are deactivated
- their signed-in sessions are ended
- their API keys are revoked
- they're cleared as the owner of any device
- delegations they granted are revoked
- access granted to them through a partner (MSP) is removed
What triggers it
| Trigger | When |
|---|---|
| Users page | an admin removes them |
| SCIM | your IdP deactivates them (active: false) or deletes them |
| Directory sync | they're no longer in the directory, and Offboard people removed from the directory is on |
Each step is best-effort and independent, so one failure doesn't stop the rest. Offboarding is recorded in the audit log.
Before SSO is enforced
Without enforced SSO, a removed person can't sign in to this workspace anyway: their membership is gone. With SSO enforced, your IdP stops them before they reach Waxell.