Prerequisites: employee lifecycle architecture for intake and the cross-workspace handoff, and employee onboarding, because the access bundles you set up there are what offboarding revokes.
The one thing that makes this work
Every grant Ravenna makes becomes an entitlement: a record that a specific person has a specific access level on a specific application, with status, expiry, and history. That record is what makes the last day a list rather than an investigation, and it gets more complete with every request that goes through Ravenna.Learn more about entitlements
Three stages, not one
Offboarding needs a middle stage onboarding does not, because one decision cannot be made at intake: where the departing person’s data should go. HR does not know. The manager does.1
HR intake
A parent ticket in People Ops with the person and the date.
2
The manager confirms the handover
A short form asking who inherits the mailbox, the files, and the open work.
3
Each team executes on the last working day
Child tickets fire their own workflows, with revocation in a known order.
1. Build the intake
Short, and mostly about timing.Mark the form private. An offboarding is confidential until it is announced.
2. Ask the manager where the data goes
Their answers are what the IT workflow reads on the last day, and asking the manager puts the decision with the person who actually knows. The third field earns its place: it is where you hear about the vendor portal that never made it into the application catalog.
3. Know what they have before you start
Filter the Entitlements tab under Settings > Applications by user, before the last day rather than on it. You get every active grant with its access level, status, expiry, and time left, which is where you find the manual application granted eight months ago and the admin tier from a project that ended.4. Build the revocation workflow
The IT child ticket triggers this on Ticket Created. Order matters, because some steps remove the access the earlier ones need.1
Branch on urgency
If / Else on effective time. The immediate branch revokes now, the scheduled branch continues.
2
Apply the offboarding task template
Hardware return, badge collection, ticket reassignment, channel removal.
3
Wait until the last working day
Wait Until the intake date, with a small negative offset for anything needing lead time such as a courier.
4
Transfer the data first
Transfer User Data moves Drive files and calendar events to whoever the manager named. Choose the Drive scope (all, private, shared, or none) and whether to release calendar resources. It runs in the background and returns a transfer ID.Mailbox delegation has no native action, so use a Foundry action or an HTTP Request step against the Gmail API, or give it a task with a named owner.
5
Remove group memberships
Remove Users from Groups in Okta, Google Workspace, or Microsoft Entra ID unassigns everything mapped to those groups in one event, mirroring how the access was granted.
6
Revoke what is left
That difference is the one to design around, so the Ravenna record and the real system stay in step.
7
Suspend the account, do not delete it
Suspend User blocks sign-in while keeping the account, its data, and its history, so a legal hold, an audit question, or a recovery request is still answerable months later. Hold it for a retention window your legal team agrees, then delete at the end of it.
8
Verify and report
Post the outcome to the parent ticket, then recheck Entitlements. Inactive is success, Failed Revocation needs a human, Skipped Revocation means another active grant still requires the access.
Learn more about revoking entitlements and Google Workspace actions
Let Copilot build it
Describe the end state and Copilot plans the workflow before creating anything.When a ticket is created in the IT offboarding channel, apply the IT offboarding task template. Wait until the last working day on the ticket, then transfer the departing user's Drive files and calendar to the recipient named on the ticket, remove them from all their identity provider groups, and suspend their account. Post the result on the parent ticket.
When an entitlement's status changes to Failed Revocation, create a ticket in the IT triage channel with the user, the application, and the access level, and post it to #it-ops.
Learn more about building automations with Copilot
5. Cover the other teams
The rest of the leaver checklist belongs to the teams that do it, on their own child tickets.Check whether the departing person is an application owner, a named approver on an approval template, or the assignee on open tickets. Reassign all three before you suspend the account, so the next access request routes to somebody who can act on it.
The device half of this is covered in device lifecycle
6. Catch failed revocations
Add a workflow on Entitlement Status Changed, configured for Failed Revocation, that posts to your triage channel and assigns a ticket. That puts the one status you always want to act on in front of a person the moment it happens.7. Produce the compliance evidence
For SOC 2 and similar, the evidence already exists: entitlement history shows every grant and revocation with timestamps and status, and the ticket shows who did what and when, approvals included. Filter entitlements by user after the last day and you have the artifact an auditor asks for.To put it inside a compliance platform, push it there with a Foundry action or an HTTP Request step at the end of the workflow, writing the employee, the date, the applications revoked, the transfer destinations, and the suspension timestamp.The Vanta integration covers a different job: it syncs Ravenna user accounts, authentication methods, and MFA status outbound every 24 hours. Evidence for a specific leaver is the separate call you add to the workflow.
8. Shrink the problem
The best offboarding is the access that already expired. Where an access policy sets a duration, the entitlement expires on its own, counted from when access was provisioned. Put durations on anything project-shaped: contractor accounts, vendor tools, elevated production tiers, temporary admin. Then offboarding only deals with permanent access.Then once a quarter, filter entitlements by application and review the list with each application owner. That catches the larger problem, which is people who are still here and no longer need what they have. A Cron trigger can create and assign the review ticket so it happens without anyone remembering.Learn more about access duration modes and access reviews
Where teams get this wrong
Revoking before transferring
Revoking before transferring
Remove the groups first and the Drive transfer has nothing to act on. Transfer, then revoke.
Deleting the account on the last day
Deleting the account on the last day
Suspend instead. Deletion is not reversible, and it takes the audit trail with it.
Treating manual revocation as done
Treating manual revocation as done
Marking it deprovisioned in Ravenna removes nothing. Give it an owner and a task.
No immediate path
No immediate path
An involuntary departure cannot wait for a scheduled workflow, or for a manager to fill in a form.
Silent failures
Silent failures
Route Failed Revocation to a channel so a person sees it, rather than leaving it in a run log.
Ignoring untracked tools
Ignoring untracked tools
Access granted outside Ravenna is invisible here. Add those tools as manual applications, and use the manager’s special access notes to find them.
Next
Access provisioning setup
Applications, access levels, and policies from scratch.
Reporting and briefs
Report on access requests and revocations over time.