Account disablement is the security step of offboarding; the directory teardown is the governance step, and it is the one that stays half-done. A leaver's remaining memberships keep consuming licenses and keep appearing in reviews until someone finishes the job.
The teardown list#
Per leaver, four enumerations:
- Direct group memberships, each to be removed or deliberately retained for retention workflows.
- Memberships in licensed groups specifically, because each one is a seat until removed.
- Group ownerships, each needing a successor before removal, or the group joins the ownerless backlog.
- Any structural role: a group used mainly to hold this person's grants can often be retired with them.
Verify the teardown#
The checklist is only real if completion is checked. A before-and-after comparison of the leaver's directory presence, taken at offboarding start and after teardown, is the proof, and a periodic sweep for disabled accounts that still hold memberships catches the ones that slipped.
VisualizerEngine
How VisualizerEngine does it
Structural search enumerates a user's full directory presence in one query, snapshot diffs prove the teardown completed, and the disabled-but-still-membered sweep is a saved search with utilization alerts pointing at the seats involved.