Ingested Contractors

UPN Display Name Status Risk (click for reasons) Contract End AD Expiry Manager (click to edit) Last Attested Actions
Loading…

Test Manager Notice

Set a last-login date and risk level, preview the composed manager gap-assessment email (rating badge + plain-English “why”), then send it to a manager or to yourself to confirm delivery end-to-end. Advisory-only — nothing is persisted, and no offboard is triggered.

Contractors

The Contractor Module tracks active contractors, monitors their access through continuous manager check-ins, and triggers the standard offboarding pipeline the moment a departure is confirmed. No contractor account is offboarded without explicit manager confirmation.

How It Works

The module keeps a live roster of active contractors and emails each contractor's manager on a recurring cadence to confirm whether their access is still needed. No contractor is offboarded without explicit manager confirmation (unless a tenant opts into auto-offboard at the contract end date).

How often notices go out. A monthly manager check-in, plus reminders 30 and 7 days before the anchor date (and at the date itself). At most one email per contractor per month.

What factors into risk. The risk score is computed in code (never by AI) from contract timing, the AD account expiry, how recently the manager last attested, the contractor's access footprint (privileged group membership and sign-in dormancy), and any operator-defined AD-group risk ratings — shown as a low / medium / high / critical badge.

Source of truth for dates. The contract end date from the ingested roster is the primary anchor for cadence and offboard timing. If no contract end date is supplied, the AD account expiry is used instead; when both are present they are cross-checked and a mismatch raises risk.

How AD group permissions are factored. Group membership is read from AD by the agent. Holding a privileged or sensitive group raises the score, and operators can assign an explicit risk rating (0-100%) to named AD groups under AI Assistance → AD group risk presets — a contractor in a rated group has their risk raised to at least that rating.

Email Notifications

Configure which emails are sent and when. All emails use one-click tokenised buttons — no portal login required for manager responses.

Heartbeat & Attestation
Date-Anchored Reminders
days before contract end
Asks manager to confirm extension or approve offboarding on schedule.
days before contract end
Last notice before T-0. Access will be removed unless an extension is confirmed.
Notice grouping
Per-contractor vs. ranked digest grouping is a platform-wide email-outbound setting. Configure it in Settings → Notifications → Contractor Notice Delivery — it applies to all tenants/domains.
Post-Action Notifications

Configuration

Settings apply to all contractors for this tenant. Changes take effect on the next scheduled sync or heartbeat cycle.

Drop Zone
Managed by the platform. Drop contractor roster files here to trigger a sync.
CSV minimum columns: upn, manager_upn, contract_end. Optional: display_name, vendor, department.
How often the system pulls from the source of truth. Manual sync is always available below.
Attestation Schedule
How often managers receive a check-in email for active contractors. Applies to all contractors regardless of whether a contract end date is set.
Day of month the heartbeat email cycle runs. Date-anchored reminders (T-30, T-7) are sent independently of this setting.
Grace Period & Escalation
business days
Days before an unanswered attestation email escalates to the skip-level manager.
Fallback UPN used when the AD manager chain cannot be resolved.
Offboard Action
Disable-only is useful when group membership history needs to be preserved for compliance review before removal.
Auto-offboard is an opt-in safeguard. Enable only when manager response rates are consistently reliable.
Date Discrepancy Threshold
days
A discrepancy warning is surfaced in the contractor review table. The contract end date always takes precedence for cadence scheduling.

Contractor Flow

Configure how the platform handles contractor lifecycle events — attestation requirements, auto-offboard behaviour, and HR approval gates.

Attestation & Approval
When unchecked, offboard jobs are created immediately on contract end without waiting for manager confirmation.
Adds a second approval gate — useful for SOC 2 separation of duties.
Auto-Offboard on Timeout
Off by default. Enable only when manager response rates are consistently reliable.
days after notice email is sent
Offboard Action

Email Templates

Customise the subject and body of each email type. Use {{variable}} placeholders — they are replaced at send time.

Available variables:
{{contractor_name}}   {{contractor_upn}}   {{manager_name}}   {{manager_upn}}   {{contract_end}}   {{vendor}}   {{department}}   {{attest_url}}   {{offboard_url}}
Lines starting with [Label] followed by a URL are rendered as styled buttons in the sent email.

Blob Drop Zone

Your procurement or vendor management system can drop contractor roster CSVs directly into Azure Blob Storage. The API polls every minute, processes each file, upserts contractor records, and deletes the blob automatically.

Container: contractor-drop
Path pattern: {tenant}/{filename}.csv
Poll interval: Every 1 minute
Error log: {tenant}/errors/{filename}.csv.txt

Manual Sync

Trigger a sync from the source of truth or upload a contractor roster CSV directly. The system will upsert records and apply the cadence logic immediately.

Upload contractor roster (CSV or JSON)
Drop file here or
Trigger scheduled pull now
Pulls the latest roster from the configured source of truth and upserts the contractor registry. Does not affect contractors already in offboarding or offboarded status.