Friday, 4:40 p.m.
An account manager resigns and works out the afternoon. HR records it in Workday. IT gets an email and opens a ticket for Monday. Over the weekend she still has an Okta session, VPN credentials, edit rights in Salesforce, an IAM role in the AWS account her team uses, and a badge that opens the office. Her laptop is in her bag.
Most of that gets cleaned up eventually. The part nobody can say with confidence is when, or whether all of it was, because each system belongs to a different team and the only shared record is a ticket that says “closed.”
What runs when HR enters the termination
Kinetic picks up the termination from Workday or SuccessFactors, or a manager starts it from a form. It reads her actual accounts from each connected system, then works through this list at the same time, not one team after another:
| System | What happens |
|---|---|
| Active Directory and Microsoft 365 | Account disabled, sessions revoked, mailbox converted or forwarded per the manager’s choice |
| Okta or Entra ID | User deactivated, active sessions ended |
| VPN and remote access | Credentials and tokens revoked |
| Salesforce, AWS and other applications | Licenses reclaimed, roles and IAM access removed |
| Badge system | Physical access deactivated at every site |
| Asset tracking | Return tasks for laptop, phone and peripherals, assigned to the right local team |
| Payroll and benefits | Final pay and benefits end dates sent to the owning team |
Each row reports back. The manager and HR see which are done, which failed and which are waiting on a person. Anything still open after its deadline escalates to the owning team’s lead.
Involuntary departures
These follow a separate path. When HR or security confirms one, access removal runs right away, ahead of the conversation or during it, and the rest of the list follows on its usual schedule. Who can trigger that path, and who is told, is set by you.
What the audit record shows
For each departure: the trigger, every account found, every action taken with its system and timestamp, and every exception a person approved, such as a mailbox kept for 30 days or a legal hold. When an auditor asks whether a former employee still had access on a given date, you can answer from the record without asking five teams.
GreenState Credit Union runs its employee lifecycle on Kinetic across HR, IT and security; the GreenState case study covers the onboarding side, which uses the same connections offboarding does. For the access that changes while people are still employed, see role change automation.