Updated 27 October 2026 by Simon Mestdagh, founder of Caspian.

TL;DR

• To offboard a leaver from every SaaS app, a tool needs a path into each app. SCIM is one path, but many vendors sell it only on top plans: Slack on Business+ and Enterprise (Slack help), Notion on Enterprise only (Notion help).
• Automated user provisioning without SCIM uses four routes, in order: the app's admin API, an admin session in a cloud browser, a browser extension in an admin's Chrome, or a task for a person.
• A removal is done only when the tool reads the app back and sees the account gone or deactivated. Removals should wait for a human yes, with deactivation before deletion.
• Our pick for a small IT team on Google Workspace or Entra is Caspian, which we sell. AccessOwl is the closest alternative for SaaS access alone. CloudM fits if Google Workspace data handover is the main job.
• NIST SP 800-53 control PS-4 asks you to disable access and revoke credentials within a set time when someone leaves (PS-4).

This page is for the one-person IT admin at a Mac-first company on Google Workspace or Microsoft Entra, with Slack at the centre. You know the job: someone leaves on Friday and you need every account closed by Friday evening. You also know the usual tools: suspend the Google account, then work down a checklist. This page explains how employee offboarding works when the app has no SCIM, and compares eight SaaS offboarding automation tools for 2026. Vendor facts were checked on the vendors' own pages on 27 October 2026. Caspian publishes this article and sells a product in this space. Where we give an opinion, we say so.

Why suspending the Google or Entra account is not enough

Suspending the leaver in Google Workspace or Entra blocks new sign-ins through single sign-on. It does not remove the account inside each app. Three gaps stay open:

• Apps with their own password. Anyone who signed up with email and password, not with Google or Microsoft, keeps that login.
• Live sessions and tokens. A session that is already open, or an API token the person created, can outlive the identity provider suspension.
• Paid seats and owned objects. The seat stays billed, and the person still owns repos, channels, boards and shared files until someone moves them.

So offboarding means two jobs: block sign-in at the identity provider, then revoke access in each app and hand over what the person owned. NIST SP 800-53 Rev. 5 control PS-4, Personnel Termination, sets the same bar. It opens "Upon termination of individual employment" and asks the organization to disable system access within a defined time, revoke credentials and authenticators, retrieve security-related property, and keep access to the information the person controlled (PS-4). An auditor reading an ISO 27001 or SOC 2 access-review control will ask for the same evidence.

Stolen logins remain a common way in. The 2026 Verizon Data Breach Investigations Report says 31% of breaches now start with software vulnerabilities, "beating stolen passwords as the top way attackers get in" (Verizon DBIR 2026). Stolen passwords are now second, not gone. A leaver's live account is a login that nobody watches.

SCIM is often a paid-tier feature

SCIM is the standard that lets an identity provider create and remove app accounts. Many vendors put it, and the single sign-on it depends on, on their higher plans.

App	Where SCIM is available	Source
Slack	Business+ and Enterprise. Free and Pro only with a connected Salesforce org	Slack help, checked 27 October 2026
Notion	Enterprise only	Notion help, checked 27 October 2026
Figma	Education (K-12), Organization, Government and Enterprise	Figma help, checked 27 October 2026

The "SSO Wall of Shame" at sso.tax tracks the same pattern for single sign-on. It says some vendors "gate SSO behind an 'Enterprise' paywall" and that this "can inflate the cost by 3x, 5x, 10x, or more" (checked 27 October 2026). The site covers SSO, not SCIM, but SCIM usually sits on the same plan or a higher one.

The official documentation of the two common lifecycle tools shows the same dependency. Okta Lifecycle Management "supports automated provisioning for thousands of apps using the SCIM standard" (Okta Lifecycle Management) and provisions into "SCIM-enabled app integrations" (Okta help). Microsoft Entra lifecycle workflows can "automate the disabling and removal of user accounts" and need Microsoft Entra ID Governance or Microsoft Entra Suite licences (Microsoft Learn). Both handle the identity well. Neither reaches an app on a plan without SCIM on its own.

The result: a 150-person company can have dozens of apps where the IT admin has no SCIM, either because the app does not offer it or because the plan does not include it.

How automated user provisioning without SCIM works

Here is how provisioning and removal work technically without SCIM. A tool should try the routes in this order and fall back only when the one above is not possible.

1. The app's admin API

Most business apps have a REST API for admins, even when they do not support SCIM. It can list users, deactivate one, change a role or remove someone from a team. The tool stores an admin token or OAuth grant and calls the API directly. This is the fastest and most precise route.

2. An admin session in a cloud browser

Some apps have no admin API, or keep user removal out of it. A tool can then run a browser in the cloud, signed in to the app's admin console as an admin, and click through the same screens a person would. This works when the admin's laptop is closed. It needs a stored admin session and a recorded path through the console.

3. A browser extension in the admin's own Chrome

Some apps block cloud logins, need a hardware key, or bind the session to a device. The fallback is an extension in the admin's own Chrome. When the admin has the console open, the extension makes the change in that signed-in session.

4. A task for a person

If none of the three works, the tool sends a task to the right person: the IT admin, or the app owner in finance or marketing. The task names the app, the account and the action. The person does it and marks it done.

The point of the order: the work moves down the list only when it must. A person handles the leftovers, not the whole list.

The read-back check

A change is not done when the tool sends it. It is done when the tool reads the app again and sees the result. For each app, the check is simple:

1. List the app's users.
2. Find the leaver by email or user ID.
3. Confirm the state: deactivated, removed, or seat freed.
4. If the account is still active, mark the step failed and raise it.

Without this check, a silent API error or a changed admin page looks like success. With it, the leaver report shows each app with a state that was observed, not assumed. That report is the PS-4 evidence.

The approval step

Our view: removals should not run without a human yes. A wrong match on a common name, or a contractor who still has a week left, can lock out the wrong person. A good process:

• Proposes, then waits. The tool lists every account the person still has and the action it suggests for each.
• Chooses the least destructive action. Deactivate before delete. Transfer ownership of files, repos and channels before the account goes.
• Records who approved. Each removal shows the approver and the time.

How we picked

We ranked tools for a company of 100 to 250 people on Google Workspace or Entra, with Slack and one or two people in IT. We scored each on five questions:

1. Apps without SCIM. Does it reach apps where SCIM is missing or on a plan you do not pay for?
2. HR trigger. Does employee termination in the HR system start the leaver workflow?
3. App discovery. Does it find shadow apps the leaver signed up for on their own?
4. Approval and read-back. Does a person approve removals, and does the tool confirm each one?
5. Laptop. Does it also handle the apps and checks on the leaver's Mac?

We rank Caspian first because it was built for this reader. That is a claim from the vendor, so read the "Limits" lines. When another tool is the better pick, the list says so. We do not compare prices.

The 8 best SaaS offboarding automation tools in 2026

1. Caspian

Best for: a small IT team that wants offboarding across laptop apps, SaaS accounts and access inside apps, including apps with no SCIM and no API.

Caspian starts the leaver workflow from the HR system (HiBob, Personio, BambooHR, Workday or Rippling). It finds every account the person has from Google Workspace or Entra, the browser extension and the desktop agent. For each app it picks the first route that works: the API, the cloud browser signed in as an admin, the extension in an admin's Chrome, or an Inbox task for a person. It removes people from teams, repos, channels and roles the same way. After each change, Caspian reads the app back to confirm. Removals are never automatic: each one waits in "Access beyond the rules" until a person approves it, and Caspian proposes deactivation before deletion. Caspian Desktop handles the apps on the Mac, including Macs not enrolled in an MDM. Joiners run the same routes in the other direction.

Data is stored in the EU (AWS Frankfurt), an independent pen test is planned, and ISO 27001 and SOC 2 are in progress. Caspian starts read-only, with a free scan (pricing).

Limits: Caspian is not an identity provider, so sign-in stays with Google Workspace or Entra. It does not reclaim licences, track SaaS spend or manage Windows and phones yet.

2. AccessOwl

Best for: a team that wants SaaS access requests, reviews and offboarding in Slack, without device management.

AccessOwl says it has "400+ integrations, including the long tail of apps with no APIs or SCIM/SAML support" and "doesn't require upgrades to enterprise plans for SCIM/SAML support" (AccessOwl). It offers "Automatic onboarding and offboarding triggers from your HR system", access requests in a Slack app, and shadow IT scanning that "Flags discovered apps to remove at offboarding."

Limits: the homepage does not explain how it reaches apps without an API. It does not cover the laptop.

3. BetterCloud

Best for: a larger IT team that wants a no-code workflow builder with many prebuilt actions across Google Workspace, Microsoft 365 and Okta.

BetterCloud lets you "Automate employee onboarding and offboarding with dynamic workflow decisioning and workflow scheduling" and claims "100+ integrations and 1,000+ actions provided out-of-the-box" (BetterCloud). Its IT Agent asks for approval: "Every action requires your explicit approval before it executes." It also surfaces shadow IT and unused licences.

Limits: the homepage does not name HR systems as triggers or say how it reaches apps outside its integration list.

4. Torii

Best for: a team whose main goal is SaaS discovery and licence cost, with offboarding as part of it.

Torii says it "discovers your entire SaaS and AI stack, reclaims wasted spend, and automates onboarding and offboarding" (Torii). It finds apps from "finance, identity, HR, and browser-level signals" and can "offboard access automatically" with an audit trail.

Limits: the homepage does not say how it removes users from apps without an integration.

5. Zluri

Best for: a company that wants identity governance, access reviews and SaaS management across human and non-human identities.

Zluri covers discovery, governance with "Lifecycle automation", posture with "1,500+ automated actions", and a Universal Identity Connector with "No native integration required" (Zluri).

Limits: the homepage does not mention offboarding by name. It is built for governance programmes larger than a one-person IT team.

6. Lumos

Best for: a security team that wants AI agents to run access reviews, just-in-time access and joiner-leaver changes.

Lumos says "Lifecycle events flow straight from your HRIS" and "leavers are fully offboarded with licenses reclaimed automatically." Access requests come in "Slack, your IT system, or through MCP" (Lumos).

Limits: the homepage does not mention SCIM or how it handles apps without provisioning APIs.

7. Reco

Best for: a security team that wants SaaS and AI agent security, with offboarding as one use case.

Reco lists "SaaS Offboarding", application discovery and shadow agent discovery among its use cases, with "285+ app integrations" (Reco).

Limits: Reco leads with security monitoring. Its homepage does not describe HR-triggered workflows or apps outside its integrations.

8. CloudM

Best for: a Google Workspace company where the hard part is the leaver's mailbox, Drive and data handover.

CloudM lets admins "Automate leaver offboarding using 30+ pre-built actions" and "Reclaim licenses from leavers while retaining their data", with backup and archiving for Gmail and Drive (CloudM).

Limits: CloudM's offboarding centres on Google Workspace data. It does not remove the leaver from other SaaS apps.

Comparison table

Based on each vendor's own pages, checked 27 October 2026. "Not stated" means the page we read does not say, not that the feature is missing.

Tool	SCIM needed?	HR trigger	Shadow app discovery	Approval before removal	Laptop apps
Caspian	No: API, cloud browser, extension, task	Yes	Yes	Yes, every removal	Yes, Mac
AccessOwl	No, claims apps without APIs or SCIM	Yes	Yes	Not stated	Not stated
BetterCloud	Not stated	Not stated	Yes	Yes, IT Agent actions	Not stated
Torii	Not stated	Not stated	Yes	Not stated	Not stated
Zluri	No native integration required, per vendor	Not stated	Yes	Not stated	Not stated
Lumos	Not stated	Yes	Not stated	Not stated	Not stated
Reco	Not stated	Not stated	Yes	Not stated	Not stated
CloudM	Google Workspace only	Not stated	Not stated	Not stated	Not stated
Okta Lifecycle Management	Yes, SCIM	Yes	Not stated	Not stated	No
Entra lifecycle workflows	Entra accounts	Yes, HR attributes	Not stated	Not stated	No

Slack and Google Workspace offboarding: a leaver checklist

For a Slack and Google Workspace company, the leaver day looks like this, whatever tool runs it:

1. HR sets the last day. The leaver workflow starts.
2. Suspend the Google Workspace or Entra account at the agreed time.
3. Transfer Drive files and calendar ownership to the manager.
4. Deactivate the Slack account and hand over channel ownership.
5. For each other app, revoke access by the first route that works, and read it back.
6. Remove the person from repos, teams and roles inside each app.
7. Collect the Mac, or remove company apps from a BYOD Mac.
8. File the report: each app, its observed state, and who approved each removal.

Questions to ask

1. Which of our apps can you remove a user from without SCIM, and by which route?
2. What happens when an app has no API at all?
3. Do you read the app back after each change, and where do I see the result?
4. Who approves a removal, and is deactivation the default?
5. How do you hand over files, repos and channels before the account goes?
6. Does the same tool handle the joiner, with the same routes?

FAQ

How does provisioning without SCIM work technically?

A tool uses the app's admin API where one exists. If there is none, it signs in to the app's admin console in a cloud browser, or uses a browser extension in an admin's own Chrome. As a last resort it sends a task to a person, then reads the app back to confirm the change.

Is suspending the Google Workspace account enough to offboard someone?

No. Suspension blocks new sign-ins through single sign-on, but accounts with their own password, live sessions, API tokens and paid seats stay open. You still need to deactivate the account in each app and hand over what the person owned.

Which apps need offboarding without SCIM?

Any app where SCIM is missing or sits on a plan you do not pay for. Slack offers SCIM on Business+ and Enterprise, Notion on Enterprise only, and Figma on Organization, Enterprise and a few other plans.

What does NIST SP 800-53 PS-4 require at employee termination?

PS-4 asks the organization to disable system access within a defined time, revoke credentials and authenticators, hold an exit interview, retrieve security-related property, and keep access to information the person controlled. A per-app removal report with observed states is the evidence for it.

Should offboarding removals run automatically?

Our view is no. A wrong match can lock out the wrong person, so each removal should wait for a person to approve it, with deactivation before deletion. The tool should prepare the list and do the work after the yes.

Sources

Source	Publisher	Date	Confidence
SCIM provisioning	Slack	Checked 27 Oct 2026	High
Provision users and groups with SCIM	Notion	Checked 27 Oct 2026	High
Set up automatic provisioning via SCIM	Figma	Checked 27 Oct 2026	High
SSO Wall of Shame	sso.tax	Checked 27 Oct 2026	Medium (community list, covers SSO only)
NIST SP 800-53 Rev. 5 PS-4	NIST, via CSF Tools	Checked 27 Oct 2026	High
2026 Data Breach Investigations Report	Verizon	Checked 27 Oct 2026	High
Okta Lifecycle Management	Okta	Checked 27 Oct 2026	High (vendor page)
About SCIM provisioning	Okta	Checked 27 Oct 2026	High
What are lifecycle workflows?	Microsoft	Checked 27 Oct 2026	High
AccessOwl	AccessOwl	Checked 27 Oct 2026	High (vendor page)
BetterCloud	BetterCloud	Checked 27 Oct 2026	High (vendor page)
Torii	Torii	Checked 27 Oct 2026	High (vendor page)
Zluri	Zluri	Checked 27 Oct 2026	High (vendor page)
Lumos	Lumos	Checked 27 Oct 2026	High (vendor page)
Reco	Reco	Checked 27 Oct 2026	High (vendor page)
CloudM	CloudM	Checked 27 Oct 2026	High (vendor page)
Pricing	Caspian	Checked 27 Oct 2026	High (our own page)

See what a leaver still has in your apps: request access.

← All resources