PIM Manager settings · Settings > Approvals & policy

Automatic offboarding

Key	EnableAutomaticOffboarding
Where	Settings > Approvals & policy > Automatic offboarding
Type	On / off
Default	Not set: off in a production tenant, on in a tenant named as a test tenant

What it does

Decides whether the engine acts by itself on an admin account that is due for offboarding: its offboard date has passed, it is marked Retire, or its status is Revoked. The offboarding job (admin-offboarding) reads the switch at every run. The card shows the state in effect and where it comes from. PIM Manager asks for confirmation before the switch is changed, in either direction.

When enabled

When on: from its next run the offboarding job disables such an account, signs it out everywhere, removes its group memberships and eligibilities and sends the offboarding notice. The account itself is never deleted.

When disabled

When off: the offboarding job does nothing for these accounts. The group memberships and eligibilities such an account holds stay until the switch is on or somebody removes them by hand.

Risk and how to reverse it

On: access is removed without a person looking at each account, so a wrong offboard date or a wrong Retire mark takes a working administrator's access away. The account-disable guard still applies and cannot be switched off here. Off: an account that should have lost its access keeps it. Switching off later does not put removed access back.

Requires

SuperAdmin to change it, with a confirmation. A setting made in the engine job's own environment wins over this switch; the card says so where PIM Manager can read it.