Disable accounts, revoke sign-in sessions, reclaim licenses, get the laptop back, and prove every step for audit — in one tracked run across Microsoft 365, Google Workspace, Okta, and JumpCloud.
The HR action — "Jane is leaving Friday" — and the IT action — "disable Jane's accounts" — almost always live in different systems on different timelines. That gap is where former-employee access lingers: an Entra account still enabled, a Google session never revoked, a paid Slack seat still billing, a laptop nobody collected. Industry breach reporting consistently ties a large share of cloud intrusions to misuse of valid-but-dormant credentials — exactly the kind an incomplete offboarding leaves behind.
Most "offboarding tools" are checklists. They remind a human to go do the work in five admin consoles, then trust that it happened. Passage runs the work and records that it happened.
When you start a leaver run in Passage, one tracked workflow drives every required action and won't let you mark it complete until the critical ones are done:
A finished run isn't just "done" — it emits a signed evidence bundle mapped to the controls auditors actually ask about: SOC 2 CC6.2/CC6.3, HIPAA §164.308(a)(3)(ii)(C) termination procedures, NIST 800-171 3.1.x / 3.5.x, NIST CSF PR.AA, and ISO 27001 A.5.18. Collect it once during the offboarding you already had to do; reuse it across every framework. See the compliance mapping for detail.
Enterprise identity-governance suites gate lifecycle automation behind a per-user platform fee and charge thousands to implement. Passage's free tier actually disables accounts, paid plans start at $4 per managed user per month, and there's no implementation call. If you run IT for a 20–500 person company — or a portfolio of them as an MSP — this is offboarding sized for you. Compare Passage vs Rippling and Passage vs BambooHR.
It runs the IT side of a departure as one tracked workflow: disable accounts, revoke active sign-in sessions, remove licenses and group memberships, convert or delegate the mailbox, reclaim devices, and produce a timestamped record proving each action happened.
Access should be cut on the employee's last working minute, not the next business day. Passage closes the HR-to-IT gap by running the leaver as a single scheduled run with a closure gate that blocks until every critical step is done.
An orphaned account is a login that still works after its owner has left. They're a leading cause of credential-misuse breaches because nobody is watching them. Offboarding software prevents them by disabling every account in a tracked, provable run.