Deprovisioning Workflows

Automated deprovisioning removes access when an employee leaves the organization or changes roles. When Workday or Okta signals a termination event, CoreLink executes a configurable workflow: revoke all secret access, terminate active sessions, disable AD accounts, remove group memberships, and expire pending approvals. The entire sequence is logged as a single correlated audit event.

Partial deprovisioning handles role changes (movers) by revoking access that is no longer appropriate while preserving entitlements that carry over to the new role.

Key Configuration

• Trigger sources (Workday, Okta, manual)
• Workflow steps (revoke, disable, notify)
• Grace period before final deletion
• Mover detection rules