Offboarder Admin Portal
Jobs, domains, and agent presence monitoring
Downstream Connectors
Systems the offboarder pushes deprovisioning to when a user leaves. Select one to configure it. Active Directory, Entra ID, Google Workspace, Okta, Delinea, JumpCloud, AWS, GitHub, and Local Accounts (CrowdStrike) are functional today.
Upstream Connectors
Systems that feed offboarding events in — HR / ITSM sources that raise or track a leaver request. Coming soon.
Connectors
Loading…
Select a domain or click + New to create one.
Domain Identity
AD / Domain Scope
Policy
Active Agents
— online = last seen < 5 min ago
| Agent ID | Hostname | Domain | Last Seen (UTC) | Status | Script Version | LDAP Bind | DC Cert |
|---|---|---|---|---|---|---|---|
| Select a tenant to load agents. | |||||||
Entra ID Tenants
Configure Entra ID tenants for cloud identity offboarding. Requires the Entra ID Module.
| Display Name | Tenant ID | Slug | UPN Domains | Actions | Status | |
|---|---|---|---|---|---|---|
| Loading… | ||||||
Add Entra ID Tenant
Comma-separated. When a job UPN matches one of these domains, this Entra tenant config is used.
Google Workspace
Service account + domain-wide delegation. Actions: sign out, suspend, revoke OAuth tokens, remove from priv groups. Spec: Connectors.md.
| Display Name | Slug | Admin Email (DWD subject) | UPN Domains | Actions | Status | |
|---|---|---|---|---|---|---|
| Loading… | ||||||
Add Google Workspace Tenant
When editing an existing tenant, leave empty to keep the existing SA JSON in KV. Paste a new one only to rotate.
Two ways to provision this connector:
Option A (recommended) — Setup Script
Fill in Slug, GCP Project ID, Admin Email, domains, actions. Click Download Setup Script below. Script does (i) gcloud SA creation + key download, (ii) pauses with paste-ready DWD instructions for admin.google.com, (iii) az upload to KV, (iv) self-cleanup. Then click Save here and Test on the row.
Fill in Slug, GCP Project ID, Admin Email, domains, actions. Click Download Setup Script below. Script does (i) gcloud SA creation + key download, (ii) pauses with paste-ready DWD instructions for admin.google.com, (iii) az upload to KV, (iv) self-cleanup. Then click Save here and Test on the row.
Option B — Paste existing SA JSON
If you already have an SA + DWD configured: paste the JSON below + Admin Email, click Save. KV is written from the form. Required Google-side prereqs:
If you already have an SA + DWD configured: paste the JSON below + Admin Email, click Save. KV is written from the form. Required Google-side prereqs:
- Google Cloud Console → SA exists in your project
- Workspace Admin Console → DWD → SA client_id authorized with these 3 scopes (comma-delimited):
https://www.googleapis.com/auth/admin.directory.user, https://www.googleapis.com/auth/admin.directory.user.security, https://www.googleapis.com/auth/admin.directory.group.member
Comma-separated. When a job UPN matches one of these domains, this connector config is used.
Cross-connector correlation: enable Employee ID if HR populates the same ID in AD, Entra, and Google (most reliable). Employee Name is a fallback when emails diverge across systems.
Okta
Okta Management API (SSWS token). Actions: clear sessions, remove app assignments, remove from groups, suspend, deactivate. Spec: Connectors.md.
| Display Name | Slug | Org URL | UPN Domains | Actions | Status | |
|---|---|---|---|---|---|---|
| Loading… | ||||||
Add Okta Tenant
When editing an existing tenant, leave empty to keep the existing token in KV. Paste a new one only to rotate.
How to provision this connector:
- In the Okta Admin console → Security → API → Tokens → Create Token. Name it (e.g.
offboarder-{slug}). The token inherits the permissions of the admin who creates it — use an admin scoped to user lifecycle + group management. - Copy the token value (shown once). Paste it into the API Token field above.
- Fill in Org URL, domains, actions, resolution order. Click Save — the token is written to KV.
- Click Test on the row — expect
ok:true,org_reachable:true.
Comma-separated. Informational for routing display — fan-out attempts every enabled Okta tenant regardless.
Cross-connector correlation: enable Employee ID if HR populates the same ID in AD, Entra, and Okta (most reliable). Employee Name is a fallback when emails diverge across systems.
Delinea
Delinea Secret Server (PAM) REST API. OAuth2 password-grant service account. Actions: disable, remove from groups, delete. Spec: Connectors.md.
| Display Name | Slug | Base URL | UPN Domains | Actions | Status | |
|---|---|---|---|---|---|---|
| Loading… | ||||||
Add Delinea Tenant
When editing an existing tenant, leave empty to keep the existing password in KV. Paste a new one only to rotate.
How to provision this connector:
- In Secret Server, create a dedicated offboarding application/service account scoped to user lifecycle + group management (Administer Users role).
- Ensure REST API + OAuth2 password-grant is enabled (Admin → Configuration → Application Settings → Enable Web Services).
- Fill in Base URL, username, password, domains, actions, resolution order. Click Save — the password is written to KV.
- Click Test on the row — expect
ok:true,api_reachable:true.
Comma-separated. Informational for routing display — fan-out attempts every enabled Delinea tenant regardless.
Secret Server has no native Employee ID field, so Employee Name is the strongest cross-system anchor here. Username/email are fallbacks when AD UPN equals the Secret Server login.
JumpCloud
JumpCloud API (Service Account, OAuth2). Actions: remove from groups, unbind systems, suspend, delete. Spec: Connectors.md.
| Display Name | Slug | Org ID | UPN Domains | Actions | Status | |
|---|---|---|---|---|---|---|
| Loading… | ||||||
Add JumpCloud Tenant
When editing an existing tenant, leave empty to keep the existing secret in KV. Paste a new one only to rotate.
How to provision this connector:
- In the JumpCloud Admin Console → Settings → API Service Accounts → create a service account scoped to user management.
- Copy its Client ID and Client Secret (the secret is shown once). Paste them above.
- Enter the Org ID (Settings → organization). Fill domains, actions, resolution order. Click Save — the secret is written to KV.
- Click Test on the row — expect
ok:true,api_reachable:true.
Comma-separated. Informational for routing display — fan-out attempts every enabled JumpCloud tenant regardless.
Cross-connector correlation: enable Employee ID if HR populates the same id in AD, Entra, Okta, and JumpCloud (most reliable). Employee Name is a fallback when emails diverge across systems.
AWS
AWS IAM + IAM Identity Center (access-key auth). Actions: revoke SSO assignments, disable IAM access, remove IAM groups, detach IAM policies, delete users. Spec: Connectors.md.
IT admin setup — hand one of these to the customer's AWS administrator to provision the connector's least-privilege IAM role (a scoped policy, never
IAMFullAccess) plus a base user with sts:AssumeRole only. Neither artifact stores credentials — the script prompts for them at run time, CloudFormation runs under the deployer's own session.
The script is interactive (AWS CLI, IT admin runs it once). The CloudFormation template is for CI/CD:
aws cloudformation deploy --template-file <file> --stack-name offboarder-aws-connector --capabilities CAPABILITY_NAMED_IAM. Both output the access key id, secret, and assume-role ARN to paste into the form below.| Display Name | Slug | Region | UPN Domains | Actions | Status | |
|---|---|---|---|---|---|---|
| Loading… | ||||||
Add AWS Account
Access key = a long-lived IAM secret. X.509 = a client certificate exchanged for short-lived credentials via IAM Roles Anywhere (no standing secret).
When editing an existing account, leave empty to keep the existing secret in KV. Paste a new one only to rotate.
When editing an existing account, leave empty to keep the existing key in KV. Paste a new one only to rotate.
How to provision this connector:
- In the AWS Console → IAM → Users → create an offboarding user with programmatic access. Attach a policy granting IAM user-management +
sso:*/identitystore:*for the actions you enable. - Create an access key for that user (key id + secret are shown once). Paste them above.
- For IAM Identity Center: copy the Identity Store ID and SSO Instance ARN from IAM Identity Center → Settings. Leave blank if you only offboard IAM users.
- Fill domains, actions, resolution order. Click Save — the secret is written to KV. Then click Test — expect
ok:true,iam_reachable:true.
Comma-separated. Informational for routing display — fan-out attempts every enabled AWS account regardless.
Cross-connector correlation: enable Employee ID if HR populates the same id in AD, Entra, Okta, JumpCloud, and the AWS Identity Center
ExternalId (most reliable). IAM users have no email/employee field — resolution there falls back to matching the username.GitHub
GitHub organization access. Actions: remove org membership (destructive), remove from teams, revoke SSO credential. Two auth modes per tenant: GitHub App (recommended) or fine-grained PAT. Four identity strategies tried in order: SAML / SCIM / mapping / local-part. Spec: Connectors.md.
| Display Name | Slug | Org | Auth | UPN Domains | Actions | Status | |
|---|---|---|---|---|---|---|---|
| Loading… | |||||||
Add GitHub Org
PAT is tied to a human user account (churn risk if they leave). App is installed in the org once and grants the connector scoped permissions; the connector mints short-lived installation tokens per request.
Accepts a classic token (scope
admin:org) or a fine-grained token (org permissions: Members = Read & write, Administration = Read-only). Classic: github.com/settings/tokens. Fine-grained: github.com/settings/personal-access-tokens. When editing an existing tenant, leave empty to keep the existing token.Download the PEM from the App's settings (Generate a private key). When editing an existing tenant, leave empty to keep the existing PEM. Paste a new one only to rotate.
How to provision this connector:
- PAT mode: Generate a fine-grained PAT at
github.com/settings/personal-access-tokenswithadmin:org+read:orgscopes on the target org. Paste above. Cannot revoke SSO credentials of other users —revoke_ssoon PAT mode will returnneeds_review. - App mode (recommended): Create a GitHub App at
github.com/settings/apps. Required permissions: Organization > Members (Read & write), Organization > Administration (Read). Generate a private key (downloads as PEM). Install the App in the target org (note the Installation ID from the URL:github.com/organizations/<org>/settings/installations/<installation_id>). Paste App ID, Installation ID, and PEM above. - Click Save — secrets are written to KV. Then click Test — expect
ok:true,org_reachable:true.
Comma-separated. Informational for routing display — fan-out attempts every enabled GitHub tenant regardless.
SAML/SCIM are highest fidelity (require SAML SSO or SCIM provisioning on the org). Mapping table is the fallback for non-SAML orgs and EMU. Local-part is the lowest-fidelity convention — works only when org usernames are minted from corporate email local-part.
Plain JSON object mapping any identifier the offboard record carries to a GitHub login. A key may be a UPN, display name, employee ID, contractor ID, or email — the resolver tries each in that order. Contractors often have no corporate email, so display name / contractor ID are the dependable keys. Keys are lower-cased + matched case-insensitively. Leave as
{} when not using the mapping strategy.Azure DevOps
Azure DevOps REST API (Entra app, client_credentials). MVP action: remove user from organization (frees license + kills access). Spec: Connectors.md. Setup script provisions app reg, KV secret, SP entitlement, and PCA group membership in one run.
| Display Name | Slug | Org URL | UPN Domains | Actions | Status | |
|---|---|---|---|---|---|---|
| Loading… | ||||||
Add ADO Tenant
When editing an existing tenant, leave empty to keep the existing secret in KV. Paste a new one only to rotate.
How to provision this connector:
- Fill Slug, Tenant ID, Display Name, and Organization URL above, then click Download Setup Script.
- Run the PS1 in PowerShell 5.1. The script handles everything in one pass:
az login→ createOffboarder-AdoOffboard-{slug}app reg → mint client secret → writeado-client-secret-{slug}to KV → entitle the SP to the ADO org (Basic access) → add it to Project Collection Administrators. Requires: Global Admin on the client Entra tenant, KV Secrets Officer on the Offboarder KV, and PCA on the target ADO org (the operator running the script — SPs can’t grant themselves rights). - Paste the Client ID printed by the script back into the form (leave Client Secret blank — already in KV). Click Save.
- Click Test on the row — expect
ok:true,token_loaded:true,org_reachable:true.
The ADO org MUST be Microsoft Entra-backed (Org Settings → Azure Active Directory shows a connected tenant). MSA-backed orgs reject AAD service principals; the script will surface a clear error if it hits one.
Comma-separated. Informational for routing display — fan-out attempts every enabled ADO tenant regardless.
PAT revoke and per-project membership removal are deliberate follow-ups (see PR #844 body).
ADO users are Entra-backed for AAD-linked orgs — UPN is the reliable key.