How to Automate Employee Offboarding with Make.com™: Secure, Step-by-Step Guide

Employee offboarding is a security event. Treating it as an administrative formality — a checklist someone works through when they get around to it — is how organizations end up with former employees who still have active system access two weeks after their last day. The solution is a single automated trigger that fires every downstream action simultaneously, without relying on anyone’s memory. This guide shows you exactly how to build that in Make.com™.

This satellite is one component of the broader strategy covered in Make.com for HR: Automate Recruiting and People Ops — the parent pillar that frames how automation and human judgment interact across the full employee lifecycle. Offboarding is where that lifecycle closes, and it deserves the same architectural rigor as onboarding or recruiting.

Asana’s Anatomy of Work research consistently finds that workers spend a significant portion of their time on work about work — status updates, handoffs, and coordination — rather than skilled work itself. Offboarding concentrates that problem into a high-stakes, time-compressed window. Automation eliminates the coordination overhead and lets your HR, IT, and finance teams focus on decisions that actually require judgment.

Before You Start

Attempting to automate offboarding without completing these prerequisites will produce an unreliable scenario that creates more risk than it eliminates.

• HRIS with webhook or API support. Make.com™ needs a reliable trigger. Confirm your HRIS (BambooHR, Workday, ADP, or equivalent) can emit a webhook on employee status change, or that Make.com™ can poll its API on a schedule. If neither is available, a form submission can serve as a manual trigger.
• System inventory. List every SaaS application the departing employee could have access to. Group them by criticality: Tier 1 (immediate revocation required — email, VPN, code repositories), Tier 2 (revoke within 24 hours — CRM, project management tools), Tier 3 (audit and archive — file storage, collaboration tools).
• API credentials for each connected system. Gather admin-level API keys or OAuth tokens before building. Each system connection must be tested individually before being added to the scenario.
• Legal and HR sign-off on the workflow map. Your legal team must approve data-retention and deletion rules before you encode them. Your HR team must confirm the offboarding checklist is complete. Do not automate an incomplete or legally unreviewed process — automation scales both good process and bad process equally.
• A sandbox or test employee record. Never test a live offboarding scenario on a real employee record. Set up a dedicated test record in your HRIS that you can trigger repeatedly without consequence.
• Time estimate: A foundational build (trigger + IT revocation + manager task + payroll notification) takes one to three days. A full build with conditional routing, document generation, and multi-system integrations typically requires one to two focused weeks.

Step 1 — Map Every Offboarding Action Before Touching Make.com™

Build the workflow on paper before building it in the platform. Every action missed in the map is a gap in your scenario.

Divide your offboarding actions into five lanes: IT/Security, HR/Compliance, Finance/Payroll, Manager/Operations, and Communications. For each lane, list every action, who owns it, what system it touches, and whether it is time-sensitive (immediate) or can be deferred (within 24–72 hours).

Common actions by lane:

• IT/Security: Disable email account, revoke VPN access, disable SSO, transfer or archive files, remove from shared drives, revoke code repository access, recover physical hardware.
• HR/Compliance: Generate separation agreement, send NDA reminder, trigger exit survey, archive personnel file, update org chart, remove from benefits enrollment.
• Finance/Payroll: Flag termination date in payroll system, calculate accrued PTO payout, confirm expense reimbursements, close corporate card, notify finance of cost-center change.
• Manager/Operations: Send asset-retrieval checklist, assign knowledge-transfer tasks, notify team of transition, update project assignments.
• Communications: Internal stakeholder notification, external contact transition email (for client-facing roles), update email auto-responder, update directory.

This map becomes the blueprint your Make.com™ scenario executes. Gartner research on workforce transitions consistently identifies documentation consistency as a primary compliance risk — your map is where that consistency starts.

Step 2 — Configure the HRIS Trigger in Make.com™

The trigger is the single point of initiation. Everything else flows from it — which means it must be reliable, specific, and tested thoroughly.

Option A — Webhook trigger (preferred): In your HRIS admin settings, configure a webhook to fire on employee status change to “Terminated” or “Resigned.” In Make.com™, create a new scenario and add a Webhooks module as the trigger. Paste the Make.com™ webhook URL into your HRIS configuration. Send a test payload from the HRIS and confirm Make.com™ receives and parses the data structure correctly — specifically: employee ID, name, department, manager, separation type, and last date.

Option B — Scheduled poll: If your HRIS does not support outbound webhooks, use Make.com™’s scheduled trigger to poll the HRIS API every 15 minutes for records where status changed since the last run. Set a filter to pass only records with a termination-type status. This approach introduces a maximum 15-minute lag between status change and scenario initiation — acceptable for most scenarios but not for high-security environments requiring immediate access revocation.

Once the trigger is live, add a Router module immediately after it. This is where voluntary resignation and involuntary termination branch into separate paths, each with its own timing and notification logic.

Step 3 — Build the IT/Security Revocation Branch (Immediate Actions)

The IT/Security branch fires first and runs in parallel with all other branches — not after them. This is the core security advantage of automation over manual process.

For each system in your Tier 1 list, add the relevant Make.com™ module or HTTP request:

• Google Workspace: Use the Google Workspace Admin module to suspend the user account. Add a second action to transfer Google Drive ownership to the manager or a designated archive account.
• Microsoft 365: Use the Microsoft 365 modules to block sign-in, revoke active sessions, and set an out-of-office auto-reply with transition contact information.
• Slack: Deactivate the user account via the Slack API module. Optionally, post a notification to a private HR-IT channel confirming deactivation.
• Salesforce or CRM: Reassign open records to a designated owner via the Salesforce module. Disable login.
• Additional SaaS tools: For any system without a native Make.com™ module, use the HTTP module with that system’s REST API endpoint.

After each revocation action, add a data store log entry or Google Sheets row recording: system name, action taken, timestamp, and success/failure status. This audit log is your compliance record.

Add error handlers to each module. If a revocation step fails, the error handler should: (1) log the failure, (2) send an immediate Slack or email alert to the IT administrator, and (3) continue the scenario rather than stopping it — other actions must not be blocked by a single system’s failure.

Step 4 — Build the Manager Notification and Asset-Retrieval Branch

The manager receives a single, structured message that consolidates every action they need to take — no chasing separate emails across different systems.

Configure this branch to run in parallel with the IT branch, triggered by the same router:

1. Pull the employee’s asset records from your asset management system (or a Google Sheet if no dedicated system exists) using the employee ID from the trigger payload. This generates a pre-populated list of company equipment assigned to the departing employee.
2. Generate the manager task message using Make.com™’s text aggregator or a template module. Include: departing employee name and last date, asset-retrieval list, knowledge-transfer checklist (customized by role or department), exit interview scheduling link, and the deadline for each action.
3. Deliver via the manager’s preferred channel — email and Slack simultaneously for high-priority departures. Include a one-click acknowledgment link (a Make.com™ webhook URL) so the manager can confirm receipt.
4. Set a follow-up timer. If the acknowledgment webhook is not triggered within 24 hours, Make.com™ sends an escalation message to the manager’s direct supervisor.

This is the step manual processes most often skip or delay. Making it automatic and self-escalating closes the asset-retrieval gap that organizations consistently identify as the top offboarding failure point.

For teams looking to complement this with a similarly structured onboarding flow, see our guide on how to automate new hire onboarding in Make.com™ — many of the same architectural patterns apply in reverse.

Step 5 — Build the Payroll and Finance Branch

Payroll errors at separation are disproportionately costly. Parseur’s Manual Data Entry Report estimates manual data entry costs organizations approximately $28,500 per employee per year — separation data entry concentrates that risk into a single high-stakes transaction.

The finance branch should execute the following automatically:

• Flag the termination date in your payroll system via API. Pass the exact last date of employment to prevent over- or under-payment.
• Pull the employee’s accrued PTO balance from the HRIS and pass it to payroll for payout calculation per your company policy and applicable state law.
• Notify the corporate card administrator to cancel or freeze the departing employee’s card. Pass the card number or employee ID — do not require the administrator to look it up manually.
• Alert the finance team to any open expense reports pending reimbursement so they can be processed on or before the final paycheck.
• Update the cost-center or headcount model in your finance system to reflect the open position.

For a deeper look at how automation eliminates payroll data errors across the full compensation cycle, see our guide to automating payroll processing and eliminating data entry errors.

Step 6 — Build the HR/Compliance and Documentation Branch

This branch handles legal documentation, compliance filings, and the departing employee’s experience — including exit survey delivery.

• Generate separation documentation using a document generation module (DocuSign, PandaDoc, or equivalent). Pre-populate the separation agreement template with the employee’s data from the HRIS payload. Route for e-signature to both HR and the departing employee. Archive the signed document to your designated storage location automatically upon completion.
• Send the exit survey. Trigger a personalized exit survey email to the departing employee’s personal email address (not their company address, which will be disabled). Use the separation type and tenure data to customize the survey questions. SHRM research indicates exit survey response rates improve significantly when the survey arrives promptly and feels personalized rather than templated.
• Update the HRIS record to reflect offboarding completion status. This creates the audit trail that compliance reviews and future reference-check requests depend on.
• Archive the personnel file. Move relevant documents to a retention-compliant archive location. The retention period should be defined by your legal team and encoded as a Make.com™ variable — not hard-coded — so it can be updated without rebuilding the scenario.
• Remove from active benefits enrollment via your benefits platform API. Flag COBRA eligibility notification if applicable under your plan.

Harvard Business Review’s research on workforce transitions underscores that departing employees who receive a structured, respectful exit process are significantly more likely to become positive external brand advocates — an increasingly important factor as employer reputation shapes recruiting outcomes.

Step 7 — Build the Communications Branch

Internal and external stakeholders need to know about the transition — but they need to know the right things at the right time, not everything at once.

• Internal team notification: Post a message to the relevant team channel announcing the departure and transition plan. Keep it factual and forward-looking — who to contact for which responsibilities going forward.
• External contact transition (client-facing roles): For employees who manage external relationships, generate personalized transition emails from the manager’s or successor’s address, introducing the new point of contact. Make.com™ can pull the employee’s contact list from the CRM and send individualized emails for each relationship.
• Email auto-responder: Set a professional out-of-office message on the departing employee’s email account directing contacts to the appropriate successor before the account is fully archived.
• Directory and org chart update: Remove the employee from internal directories, update the org chart in your HRIS or HR portal, and update any public-facing team pages if applicable.

This branch benefits from a time delay — most communication actions should fire 24–48 hours before the last date, not immediately on trigger. Use Make.com™’s sleep or scheduled routing to manage timing relative to the last date field from the HRIS payload.

Step 8 — Add Centralized Monitoring and the Master Audit Log

Every branch generates individual log entries. This step consolidates them into a single offboarding record that HR and legal can reference.

After all branches complete — or on a timed schedule — use a Make.com™ aggregator to collect all log entries for this specific employee ID and write them to a master offboarding log. The log should capture: employee ID, name, separation type, trigger timestamp, each action taken, the system it affected, success or failure status, and the timestamp of each action.

This log is your audit trail. Gartner’s HR research identifies documentation consistency as a primary compliance risk in workforce transitions. An automated, timestamped log eliminates the risk that documentation is inconsistent, missing, or reconstructed after the fact.

Store the master log in a location your legal and HR teams can access independently — a Google Sheet, SharePoint folder, or your HRIS document archive. Do not store it only in Make.com™’s execution history, which has a retention limit.

How to Know It Worked

Run your complete scenario against the test employee record before going live. Verify each of the following:

• IT revocation: Attempt to log in to each Tier 1 system as the test employee immediately after the scenario fires. Access should be denied within five minutes of trigger.
• Manager notification: Confirm the asset-retrieval message arrived in the manager’s inbox and Slack with the correct equipment list populated from the asset system.
• Payroll flag: Confirm the termination date and PTO balance appear correctly in your payroll system — not the test employee’s data mixed with another record.
• Documentation: Confirm the separation agreement was generated with correct data fields, routed to the right signatories, and the unsigned document is accessible in the designated archive.
• Audit log: Open the master log and confirm every action appears with a timestamp and success status. Deliberately cause a test failure in one module and verify the error alert fires correctly.
• Exit survey: Confirm the survey email arrived at the test personal email address with correct personalization fields.

If any verification step fails, fix the scenario before going live. A misconfigured access-revocation step can lock out the wrong person. A mis-addressed exit survey goes to the wrong employee. Test thoroughly.

Common Mistakes and How to Avoid Them

Mistake 1 — Building a Sequential Scenario Instead of Parallel Branches

Sequential logic means IT waits for HR to finish, payroll waits for IT to finish. Use Make.com™’s router to fire all branches simultaneously from the trigger. Simultaneous dispatch is the entire security advantage.

Mistake 2 — Hard-Coding Retention Periods and Policy Rules

Legal requirements change. Store retention periods, payout rules, and compliance thresholds as Make.com™ variables or in a configuration data store — not as hard-coded values inside modules. When policy changes, update the variable, not the scenario architecture.

Mistake 3 — No Error Handling on Revocation Steps

If a revocation module fails silently, access remains active. Every IT/Security module needs an error handler that alerts a human immediately and logs the failure. Never let the scenario continue past a failed revocation without human confirmation.

Mistake 4 — Using the Company Email for Exit Survey Delivery

The company email account will be disabled as part of the scenario. Trigger exit survey delivery to the personal email address captured in the HRIS record before the scenario fires — and confirm that field is populated as part of your prerequisite checklist.

Mistake 5 — Skipping the Sandbox Test

Live testing on a real employee’s record is not acceptable. Spend the time to configure a dedicated test record. The hours invested in sandbox testing are trivial compared to the cost of a live scenario error — which, based on our experience with David’s situation (a transcription error that turned a $103K offer into a $130K payroll entry and cost $27K), can be significant.

Scaling Beyond the Foundational Build

Once the core offboarding scenario is stable, extend it with conditional logic for more complex separation types:

• Contractor offboarding: Route on employment type to skip payroll-specific steps and substitute contractor-specific documentation (1099 reconciliation, project handoff).
• International departures: Add a branch that flags the HR team for jurisdiction-specific compliance review rather than attempting to automate country-specific legal requirements directly.
• Executive departures: Add a confidentiality branch that restricts internal communications and routes notification to a smaller, defined group before any broader announcement.
• Rehire eligibility flagging: After the scenario completes, update a rehire eligibility field in the HRIS based on separation type — eligible rehires can be surfaced in future recruiting workflows automatically.

Pairing offboarding automation with a structured HR approval workflow ensures that termination decisions themselves are properly documented before the scenario fires. See our guide to automating HR approvals and eliminating errors for the upstream architecture that feeds this scenario.

For teams with limited internal capacity to build and maintain automation scenarios, designating an internal Make.com™ Champion — a dedicated owner who understands both the HR process and the automation platform — is the most reliable way to keep this infrastructure current as your tech stack and policies evolve.

Next Steps

The offboarding scenario described here is one node in a fully automated HR lifecycle. The same architectural principles — single trigger, parallel branches, error handling, audit logging — apply across every people-ops process. To understand the full scope of what that lifecycle can look like, start with the Make.com for HR parent pillar, which frames the strategic sequence for building automation across recruiting, onboarding, performance management, and offboarding without creating fragile, disconnected point solutions.

For proof of what this architecture delivers at scale, see how automation cut manual HR data entry by 95% and the Make.com™ framework for strategic HR optimization — both of which demonstrate the compound ROI of treating HR automation as infrastructure rather than a one-off project.

If you want an expert assessment of where offboarding sits in your specific automation priority stack, our OpsMap™ process maps your current HR workflows, identifies the highest-value automation opportunities, and sequences the build so you get measurable ROI before committing to a full implementation.