The IT manager’s guide to streamlining onboarding and offboarding

Successfully onboarding and offboarding employees is one of the most important tasks for an IT manager, but it’s become increasingly complex, thanks to factors like hybrid and remote work, BYOD, and employees’ prolific use of SaaS apps – including unsanctioned shadow IT. 

As an IT manager, you know that efficient and secure onboarding and offboarding are critical for a healthy business for many reasons: 

• Productivity hinges on fast access to systems and technology for new hires

• Security and compliance depend on airtight offboarding of departing employees

• Business continuity requires saving and transferring assets like files and email inboxes

To address these risks and reduce IT workload, growing businesses need to automate onboarding and offboarding processes as much as possible. 

The go-to solution for managing onboarding/offboarding is SSO, but it can’t manage every app or every account, and it doesn’t always remove users’ licenses in each app. That leaves IT managers responsible for a long list of time-consuming manual tasks.  

So how can you go beyond SSO to provide truly comprehensive, automated onboarding and offboarding? Use this guide to help your team identify gaps in your company’s onboarding and offboarding processes and assess how a SaaS management platform – like 1Password SaaS Manager – can help. 

1. Onboarding: Setting employees up for success

A new employee’s onboarding experience should be fast, frictionless, and always secure. A lot of that experience rests on IT managers’ shoulders. IT provides the platforms and tools needed to fulfill work responsibilities, manage the employee lifecycle, deliver trainings, enforce policies, and keep data secure. (IT maintains this role for existing employees too, who need access to approved apps and automated approval processes.)

IT's goal should be to make an employee’s first day “click-and-go” and avoid creating a ticket backlog of onboarding issues. A comprehensive onboarding checklist includes:   

• Provision birthright access

• Provide access to a self-serve catalog of business-approved apps

• Field access requests

• Train employees on security and compliance policies

• Assign and track assets (company-issued computer)

What’s the secret to making onboarding seamless? Reducing friction requires leaning into standardization and automation. A SaaS management platform can help.

How SSO, ITSM, and SaaS Management Platforms work together for automated onboarding

Here's what each tool brings to your onboarding process:

SSO

• Assign users to managed apps

• Manage access to sanctioned apps

• Alert IT when there's a new employee

ITSM

• Receive access request tickets

SaaS Management Platform

• Assign users to apps, regardless of SSO status

• Discover unsanctioned apps

• Assign licenses

2. Offboarding: Protecting the organization

In theory, offboarding should be as easy as flipping a switch: revoking a departing employee’s access to company systems, accounts, and data.

In reality, offboarding is more complex due to factors like disconnected systems, shadow IT, personal devices, and a remote workforce. Without a solution to track shadow IT in addition to sanctioned apps, often it can be a guessing game of who had access to what.

Without standardization and automation, it can be easy to skip an offboarding step, which can result in unnecessary risk.

Revoking access to SSO doesn’t go far enough. Fully offboarding employees requires deleting or transferring accounts so that they don’t persist in the cloud; this leads to orphaned accounts and wasted spend. This becomes nearly impossible to do for SaaS apps that IT doesn’t know about. 

A comprehensive offboarding checklist includes a systematic way to:   

• Immediately revoke access to accounts

• Recover and reassign software licenses 

• Transfer data, delete accounts

• Lock/wipe/return devices 

IT best practices for offboarding

• Integrate triggers from HR and IT platforms, such as departure/termination date 

• Automate all offboarding steps – not just access removal

  • This includes file/data recovery, email inbox forwarding/archiving, and license reclamation

• Communicate with managers to confirm termination date and actions like file transfers

• Create clear audit trails for compliance 

• Set-up automatic notifications when a deprovisioning task fails, so nothing slips through the cracks

Get more granular offboarding than SSO alone can provide

Each approach offers a different level of coverage when it comes to offboarding: Manual Processes

• Individually remove accounts from apps, usually in consultation with the employee's manager

SSO

• Ensure ex-employees can't log in to protected apps

SaaS Management Platform

• Ensure data, emails, files, and licenses are properly handled, automatically

3. Automation: An IT manager’s advantage

Let’s face it: manual onboarding and offboarding is tedious, error-prone, and unsustainable. Automation of each step – particularly for the increasingly complex and high-risk offboarding process – ensures compliance and gives IT managers their time back to do more strategic and urgent work.

What can be automated? More than you might think

Here's what 1Password SaaS Manager can automate depending on your platform:

Google Workspace

• Assign apps and groups with the right level of access

• Sign user out and auto-revoke tokens

• Clear user's recovery email

• Forward email and export inbox

• Transfer Google Drive files

• Reassign archive licenses

• Notify managers

• Delete accounts and reclaim licenses

Microsoft 365

• Add users to groups, SharePoint, and Teams

• Sign user out and auto-revoke tokens

• Transfer OneDrive files

• Forward email and save user email inbox content

• Notify managers

• Delete accounts and reclaim licenses

Automate shadow IT discovery to ensure comprehensive offboarding

Plainly, IT can’t onboard or offboard employees from apps they aren’t aware of. And since employees routinely use unsanctioned apps for work purposes, this leaves orphaned accounts and exposed data on unsanctioned applications – a threat that’s only becoming more serious with the rise of highly-permissioned AI-based tools.

Therefore, comprehensive offboarding requires IT to continually, automatically discover shadow IT apps, so they can be either blocked or brought under centralized management.

Automate provisioning/deprovisioning for apps outside of SSO

An SSO provider adds a lot of value for an organization, including removing a user’s access to federated apps. 

However, no matter how robust your SSO environment is, some apps will live outside it. These are often legitimate, enterprise-grade applications, but they’re not integrated with SSO because either the SaaS vendor doesn’t support it, it is too time-consuming or complicated to integrate, or the organization hasn’t paid for the enterprise license tier. 

1Password SaaS Manager complements SSO tools by extending governance to business-unit-managed and unmanaged SaaS apps. 

Here’s how:

• SaaS discovery: 1Password SaaS Manager helps you uncover the full footprint of apps being used at your organization, with or without IT’s knowledge. This ensures that when employees depart, IT knows exactly which apps their access needs to be revoked from.

• Breadth of integrations: With 350+ integrations, 1Password SaaS Manager connects to the tools enterprises use every day. That ecosystem means customers can extend governance and security to both business unit-managed and unmanaged apps without manual workflows.

• Unified app inventory: 1Password SaaS Manager’s app library includes more than 40,000 pre-populated profiles. That makes it easier to build a unified inventory of applications, so IT and business leaders can see what’s in use across the organization, how it’s categorized, who owns it, and how many licenses are being utilized.

• License management: 1Password SaaS Manager provides workflows to automatically identify which licenses are actually being used, or whether licenses should be revoked or reassigned. This includes automatic communication with employees over Slack and Microsoft Teams to ask if they still need a specific app license. 

Redundant applications: In addition to recovering orphaned accounts, 1Password SaaS Manager helps IT and finance teams identify redundant apps and streamline upcoming renewals. This enables teams to cut waste and make smarter SaaS investments.

4. Building a future-proof process

Successfully automating onboarding and offboarding processes requires alignment across IT, HR, and finance. A SaaS management platform helps to coordinate between various functions with several key components: 

• Alignment with HR systems (Workday, BambooHR, etc.) to incorporate triggers that kick off onboarding and offboarding workflows

• Integration of SSO (Okta, Entra ID, Google Workspace) and ITSM (Jira), with SaaS management platform (1Password SaaS Manager)

• Metrics in place to measure success, such as time-to-provision, license utilization, and deprovisioning speed

Action plan for IT managers

To get you started down the road to onboarding/offboarding automation, here are some next steps to consider.

• Immediate: Map your current onboarding/offboarding processes

• Medium-term: Automate the basics (triggered provisioning/deprovisioning)

• Long-term: Move from reactive ticket-based IT to proactive lifecycle management to anticipate future needs, risks, and optimization