Skip to main content

​
Background

When employees leave, they need to be removed from their SaaS apps. This article covers the key steps to configure and run one-click offboarding in Lumos.

​
Pre-Work: Configure Your Removal Actions

If you connected integrations in Lumos to use automated removal workflows, you can configure the removal actions ahead of running your first offboarding. Navigate to your Integrations page:

​
1. If you haven’t already, connect your integrations by clicking on the card from the list of available integrations.

​
2. Once connected, click on the integration and navigate to the ‘Integrations’ tab.

​
3. Configure the removal actions you want to run during offboardings and click ‘Save Changes’.

If empty, this means that Lumos will not run any actions when running an offboarding. (Note: This will set your “domain-wide” offboarding settings, but you can always edit these configurations if running an offboarding one-off). For certain actions, like Transfer Data, you’ll be able to configure a user on the step - this can be a named individual or manager, where applicable. You can also drag to reorder these steps.

​
4. [Optional] Configure manual removals (with instructions) for non-Lumos integrated applications.

Any application will support removal configurations - please note that if no steps are configured, these apps will be excluded from offboardings.
image.png

​
Pre-Work: Configure App Admins

Lumos automates removals for certain apps, but some applications require manual action from app owners to deprovision users. You can configure these as you’re running an offboarding, but you can also configure app admins ahead of time by navigating to the Apps table, clicking into an app, and naming an app admin by clicking the circle under “App Admins”.
Reminder: Apps that are in your AppStore already have App Admins.

​
[Optional] Pre-Work: Configure Automated Offboarding Settings

If you visit your Lifecycle Management Settings, you should see an option to configure Automated Offboarding. You can configure your Offboardings to run immediately upon deactivation. This means that upon detection of status change for a User account (I.e. Active status -> Inactive status), Lumos will trigger an offboarding to run. You can optionally choose to opt-out suspended accounts from triggering an automated offboarding, if you use this for LoAs or short term holds. [This will not be exactly in real time and you may see a delay for up to 1 hour post-detection in Lumos.]
image.png
Alternatively, if you have End Date configured in your Source of Truth Settings, you can configure your Offboardings to run x days after End Date in Lumos at a particular time on the hour. The “Apps to Include” setting by default allows two different ways to configure how to determine which accounts/apps to include as part of an Offboarding. You can read more about this here: Excluding Apps from Offboardings Auto-Offboarding triggers:
  • X Days After End Date — Lumos looks at the user’s End Date. Any user whose end date falls within the past 7 days of the specified date will be matched.
  • Immediately After Deactivation — Lumos starts an offboarding at the moment it detects a user’s status changing from active to deactivated/suspended during a sync. Users who were already deactivated in Lumos before you enabled the workflow will not be picked up, no matter how recently they were deactivated.
Example: If you enable a “0 Days After End Date” onboarding trigger on April 7th, any user created between April 1st–7th will be eligible. Users created more than 7 days ago will not be affected. If you need this Lookback Window duration modified, reach out to Lumos Support. _______________________________________________

​
Step 1: Go to the Identities Tab

So you’ve received the news from HR that an employee is leaving the company. It’s their last day, and at 5pm, you’re ready to offboard them. In Lumos, go to the Identities tab and click on the name of the user you want to offboard.

​
Step 2: Click “Start Offboarding”

Where is the button? The button is at the top right of the Users individual page. Before selecting this, you will see a table with all the apps that this user may need to be removed from. You can run this Now or Schedule it for a particular time in the future. Once you select “Start Offboarding”, you should see your accounts for that terminated employee split into two buckets:
  • Accounts to Remove (“Included” Accounts)
    • These are apps where Lumos has configured removal steps (automated via integration and/or manual tasks routed to the app admin). These also are configured automatically via Apps to Include in your Lifecycle Management Settings here.
      image.png
  • Excluded Accounts
    • These are apps that Lumos will ignore as part of the offboarding workflow. These apps are under Excluded based on your company’s Offboarding Policy and will additionally include Ignored Apps. Also, if you have no removal steps configured for the account, Lumos takes no action and will exclude the account as part of the offboarding.
      image.png

​
Go through your accounts and ensure that the accounts you want removals to run for are included and have removal workflows configured on the app. To ignore an app, exclude it from your offboarding.

Please remember that you can configure how you want to conduct the removal from the Single app page > Integrations tab, but you can always make edits directly in the modal for one-off offboarding configurations. Click ‘Save’ to keep your changes.

​
Step 4: Run the offboarding

Click “Start Offboarding”. Lumos offboards apps automatically. All Manual apps should automatically kick off deprovisioning requests to app admins.
Once confirmed, you should see the Account Status change to “Manually Removed”. This will also show in the Activity Log.
The user’s status should change to Inactive and you’ll see statuses for apps change from Active to Suspended or Deprovisioned.

​
Step 5: Complete offboarding

When all the tasks that have been generated as part of offboarding have completed, your offboarding will automatically complete. However, if you want to manually force it into a completed state, you can click “Complete Offboarding” at the top right of the User’s page to mark it as complete. Note: This will mark the In Progress apps as Manually Removed, so complete this process only when you’ve completed all the removals.

​
Bonus tip

If you already have an offboarding workflow in place, such as automated workflows that revoke access through your IdP when an employee leaves: Run one-click offboarding afterwards from Lumos. This shows you anything your existing workflow missed.

​
FAQs

​
Why did one of my Manual accounts not kick off a removal task?

Please check to see if there’s an app admin set on that application. If there isn’t, you can update the app to set an app admin. You should see a button that says Request Removal for that account. (You can do this from the “Request Removal” button or select multiple accounts and click “Request Removal” in bulk.) This will change the Account Status to “Waiting manual removal” and will notify the app admin(s) on the app to confirm that they’ve removed the user from that app.
If you click the three dots on the account, you may see options to “Cancel Next Step” or “Mark as Done”. “Cancel Next Step” will cancel the offboarding for that particular account. Warning: This is irreversible. “Mark as Done” will mark the Account Status as Manually Removed. This is the equivalent of confirming the request removal notification above.

​
My user’s End Date is in the past, but no offboarding was triggered. Why?

If your offboarding policy is set to trigger off of End Date, automatic offboarding only picks up End Dates that fall within the past 7 days at the point Lumos detects them. This is a safeguard so that older, backdated End Dates—like those that arrive when you first connect a user source, or when a date is set retroactively—don’t unexpectedly trigger a wave of offboardings. So if an End Date reaches Lumos more than 7 days after the date itself (for example, a June 2 End Date that doesn’t sync in from your HRIS until June 10), it falls outside this window and won’t trigger an automatic offboarding on its own. The End Date change will still be recorded on the identity, but no offboarding flow will run automatically. When that happens, you can still offboard the user manually from their Identity page using the “Start Offboarding” button (see Steps 1-5 above).