Skip to content

Leaver

A leaver is a person who should no longer have access — permanently, which is what separates this page from Temporary absence.

What ends access

Route What happens
The leaving date passes The job Deactivate leaving identities (00:10 every night) sets the person to Inactive. Inactive disables their accounts and removes their group memberships.
Someone sets the status to Inactive The same, immediately.
The person is deleted Their accounts are disabled, their memberships removed, and each account's retention period starts.
A business role is withdrawn The group memberships that role granted are removed.
An account definition is withdrawn That definition's account — and only that one — is withdrawn. An administrative account can go without touching the ordinary one.

Leaver — who does what

Disabled first, deleted later

An account is not deleted the moment the access behind it ends. What happens is set on its account definition, under When access is withdrawn:

When What happens
Day 0 The account is disabled and removed from its groups.
Days 1 – N If the account definition is granted again, the same account comes back — enabled, with the same name. Its groups return only through their own assignments.
Day N The account is deleted by the job Purge retired accounts (00:20 every night).

The account is deleted as soon as it is no longer justified. Nothing is left behind — and nothing can be brought back.

Withdrawn accounts waiting to be deleted are listed under Governance › Account review:

Account review — withdrawn accounts

  1. Retired — every account that is withdrawn and waiting to be deleted.
  2. State — since when, and the day the nightly purge will delete it.

Keeping accounts for a while is usually the right choice: a mistaken withdrawal, or someone who returns soon after leaving, gets the same account back instead of a new one, and the account stays auditable in the meantime.

For example, in a demo environment ordinary AD accounts are kept for 30 days and administrative accounts are deleted at once.

A missed night catches up

Purge retired accounts deletes every account that has outlived its retention, not only those whose period ended exactly today — so a night when the service was down is made up for on the next run.

Someone who comes back

If a leaver returns — their status is set back to Active, or HR re-activates them — their accounts are enabled again and the group memberships that were removed when they left are restored, as long as their roles still grant them.

Finding what is left behind

The job Review accounts for orphans (00:30 every night) looks for accounts that no person owns, accounts whose owner has been deleted, and accounts whose owner is no longer entitled to them, and reports what it finds — it changes nothing. The same findings are always on Governance › Account review, where each account says why it was flagged.