SCIM offboarding for B2B SaaS: what teams still miss

TL;DR: Employee termination in HR or identity systems automatically revokes app access and records it, according to Clerk, because HR-driven offboarding for B2B SaaS depends on SCIM, webhooks and audit trails. The control gap remains broader than login removal because active sessions, tokens and orphaned accounts can survive manual offboarding.

Editorial analysis by NHI Mgmt Group, based on content published by Clerk: “HR-driven offboarding for B2B SaaS: SCIM, webhooks, and audit trails”.

Key questions

Q: What breaks when HR-driven offboarding only disables login but not sessions?

A: The control breaks because a disabled login does not necessarily end active sessions, app roles or downstream tokens.

Q: Why do delayed offboarding processes create security risk?

A: Delayed offboarding creates security risk because access can remain active after the business relationship ends.

Q: How can security teams know if deprovisioning is actually working?

A: Security teams should test whether a terminated user still has any live access in downstream applications, not just whether the central directory shows removal.

Practitioner guidance

• Define offboarding as full access removal Require every leaver workflow to end account access, active sessions, app roles and downstream entitlements, not just disable login.
• Validate session revocation behaviour Test whether a deprovisioning event actually kills live sessions, refresh tokens and other residual access in each application.
• Tie audit evidence to each deprovisioning event Log the user identifier, timestamp, source event and final access outcome so the organisation can prove revocation and investigate failures.

Bottom line: HR-driven offboarding is only effective when termination closes every access path, including sessions and application-specific entitlements.

Explore further

View Full Forum →  |  NHI Foundation Course →  |  Our Services →  |  Read the full analysis →