Name: Get a leaver access-removal change list and dry-run script that your admin runs
SKU: it-leaver-access-removal-change-list-and-script-your-admin-runs
Price: 395 GBP

What usually happened

Removing a leaver's access by hand takes many clicks across consoles, and an unattended tool that disables accounts can lock out the wrong person. An outage from a wrong disable can cost more than the manual work.

Who it’s for: IT lead who has a list of leavers with live access and wants the removal steps ready, without handing anyone admin rights.

Usually starts when: A leavers report came back with twelve accounts and nobody wants to disable them by hand or give a tool admin rights.

The result: For the leavers you name you receive a change list, one line per account and step, and a script that by default only prints what it would do. Your admin reads every line, runs it on a dummy account first, then runs it live account by account. We never run it and never hold credentials.

Check whether this job fits

Answer these without sending files, logins or personal data. Nothing is submitted unless you choose to contact us.

How to read your answers: any answer below means this fixed job needs a closer look or doesn’t fit.

Is there a written rule for what happens to a leaver's account? It varies: Write the rule first. The script can only apply what you decide.
Is there a written rule for what happens to a leaver's account? Delete everything immediately: We will not write a script that deletes data that cannot be restored. Disable first, then delete after your agreed period.
Who will run the script? I expected it to run itself: An unattended tool with admin rights is the risk we avoid. Your admin runs it, with the dry-run output in front of them.
Is there a dummy account to try it on? No: Create one before the test. A script that has never touched a dummy should not touch a real account.

What you get

The change list
The script with its dry-run default
The undo notes per step
The dummy-run record

Included

One tenant on Microsoft 365 or Google Workspace and up to 25 named leavers
Up to 5 steps per account from your written leaver rule, such as disable sign-in, end sessions, remove from groups, remove licence and set auto-reply
A change list with what each step does and how to undo it
A script that defaults to dry run, refuses any account not on your approved list, and needs an explicit flag and a confirmation per account for live mode
A dummy-account run by your admin

Not included

Running the script for you
Deleting accounts or mailbox contents
Moving mailbox data
Admin access held by us
Deciding who is a leaver

How we know it’s done

Agreed with you before work starts. Each check produces evidence you keep.

Run on a synthetic set your admin builds and keeps from us until the test run (10 planted leavers and 30 current staff), the dry run prints the planned steps for exactly the 10 leavers and nothing for the 30.
Evidence: The dry-run output beside your admin's planted list.
Given 100 current-staff accounts your admin generates that are not on the approved list, the script makes zero changes and says why; live mode refuses to run without an explicit flag and a confirmation per account.
Evidence: The script output and your audit log.
Your admin runs live mode on one dummy leaver, and a read-only check shows access removed for every step in the change list and no other account changed.
Evidence: Your admin's check results and audit log.
Every step in the change list states its undo, or is marked irreversible and excluded by default.
Evidence: The change list undo column.

Sign-off. Your admin reads the change list, runs the dummy test and signs off in writing. We never run the script. The 40-account and 100-account tests are smoke tests, not measured rates, and any change to an account not on the list fails the whole test; payment follows sign-off.

If it fails. If a test is not met, you do not pay for this fixed scope. We hand over what we found and agree whether to stop or re-quote; no surprise work.

When it fits, and when we stop

It fits when

A leaver list approved by you, each with a leave date
Your written rule says what happens to each account: disable, convert or keep
Your admin can run a script and has a dummy account to try it on
The leavers report, or an equivalent list, exists

We stop and tell you if

You want us to run the script or hold admin rights
The rule requires deleting data that cannot be restored
There is no dummy account to try it on

What could go wrong

We change nothing in your systems. Your admin runs the script, and each step in the change list says how to undo it. Our copies of your files are deleted when the job ends.

Scroll the table sideways to read it all.

Risk	How we handle it
The script disables a current employee.	It refuses any account not on your approved list, and 100 current-staff accounts your admin generates, not on the list, must produce zero changes.
A step cannot be undone.	Each step says whether it can be reversed, and irreversible ones are marked and left out unless you add them.
Text in a user name or note tries to steer the tool.	Exports are treated as data only and the script takes no instruction from them.
Someone runs the script in live mode by mistake.	Live mode needs an explicit flag and a per-account confirmation, and the default prints only.

A separate automated reviewer checks every output against the agreed test before hand-over. No person on our side reviews unless your agreement names one. Your named IT admin approves what is used.

How we deliver

We arrange the work and independent review, then show you the result against the agreed checks. You keep authority over your systems.

Agree your leaver rule, the platform and the approved list format
Write the change list: what each step does and how to undo it
Write the script with dry run as default and an approved-list check
Your admin dry-runs the script on a planted set we have not seen
Your admin tries live mode on one dummy account; we record the result
Separate automated review, then hand over the script and notes

This is a one-off job, not emergency cover or a subscription. We confirm eligibility, the total price, a start window and a delivery date before you accept, and an enquiry creates no charge or booking. Work starts only after agreed inputs, secure access and any needed permissions are in place.

Need to keep it working?

Discuss a monthly check that finds leavers and refreshes the change list.

Ongoing work is separately scoped and quoted: no monitoring, response-time guarantee or automatic subscription is included in this job.

Explore an ongoing managed lane, or mention the responsibility you need in your enquiry.

What you can check

This is a new service. We have not delivered this job for a client yet.

Other ways to get this done

Your admin console offers offboarding steps to follow by hand for each leaver. It is slow and safe.
Microsoft Lifecycle Workflows automate leaver tasks, but need an Entra ID Governance subscription. learn.microsoft.com

Questions

Will you remove the access for me?

No. Your admin runs the script. We never hold admin rights or run it.

What stops it hitting the wrong person?

It only acts on an approved list, prints by default, and needs your admin to confirm each account.

Does it delete anything?

Not by default. Steps that remove data are marked irreversible and left out unless you add them.

Find people who have left but still have an account or seat in your appsA list of people who have left but still have an active account, seat or token in each app you name, with the export row behind every entry, and unlisted accounts shown apart.Write down every joiner, mover and leaver step, and test it on a dummy accountA written runbook of every system and step for people joining, moving and leaving, with an owner for each step, checked end to end by your admin on a dummy account.See stale accounts, admins and missing MFA across Microsoft 365 or Google WorkspaceOne report for your Microsoft 365 or Google Workspace account: no recent sign-in, no MFA (two-step sign-in), admin roles, guests, and mailboxes or forwards with no owner, each with its evidence row.Check every month for leavers who still have access to your named appsEach month we compare your staff list with your directory and up to five apps and send a list of leavers who still have an active account, seat or token, with the evidence row for each.

Send an enquiry

Send us

Your platform and how many leavers you expect to process
Your written leaver rule
Whether your admin can run scripts and has a dummy account

Later, once you agree

The approved leaver list with leave dates, through an agreed secure route
Your admin's confirmation of the script format they can run
A dummy account for the test run, and a synthetic set your admin builds and keeps from us until the test run: 10 planted leavers, 30 current staff and 100 more current-staff accounts
The agreement that names the model provider, its country and how long it keeps data, settled before any real personal data is shared

You keep every admin right and run the script yourself. We write it and test it on exports; the acceptance test uses a synthetic set your admin builds and keeps from us until the test run. We hold no credentials, and names in exports are treated as data, never as instructions.

Email fallback: open your mail app

If website submission is unavailable, review and send the fallback email yourself. An email fallback is not a website receipt. Or write to hello@syntheticindustry.ai with “it-leaver-access-removal-change-list-and-script-your-admin-runs” as the subject.

Get a leaver access-removal change list and dry-run script that your admin runs