How to Automate Employee Offboarding Between UKG and Active Directory
When a termination in UKG doesn't reach Active Directory, former employees keep their access. Here's how to close that gap with automated deprovisioning.
Ask a security auditor where access problems start and many will point to offboarding. HR processes a termination in UKG, but the user account stays active until someone in IT hears about it. Sometimes that takes a day. Sometimes it takes weeks.
Every hour an account stays enabled after someone leaves is an hour of unnecessary risk. Automating offboarding removes the wait.
Why manual offboarding breaks down
The handoff depends on people. HR has to remember to tell IT, and IT has to pick up the ticket.
Terminations happen at awkward times. Late on a Friday, during the holidays, or when the person who usually handles them is out.
Disabling the account is not enough. Group memberships, licenses and shared mailbox access often stay in place.
There’s no clear record. When an auditor asks when access was removed, the answer is spread across tickets and emails.
What automated deprovisioning looks like
With User Deprovisioning, UKG becomes the trigger. When an employee is terminated in UKG, the next sync:
Disables the account in Active Directory or Entra ID
Moves it to your disabled users OU
Resets the password
Removes security and license groups
Notifies IT, security or the manager with the details
You decide the timing. Accounts can be disabled the same day the termination is entered, or the day after the employee’s last working day, so nobody is locked out before they finish.
Handling the edge cases
Real offboarding is rarely one clean event. A few situations to plan for:
Rehires. Matching rules let you link a returning employee to their existing account instead of creating a duplicate.
Accounts that must stay disabled. Per-user overrides keep an account disabled even if the employee shows as active in UKG, and the sync won’t re-enable it.
Service and shared accounts. Connect to AD only acts on accounts linked to a UKG record, so service accounts and shared mailboxes are never touched.
Records you need to keep. Accounts are disabled and moved, not deleted, so mailboxes and files are still there if you need them later.
Prove it to your auditors
Every sync is logged and every change is traceable. When an auditor asks how quickly access is removed after a termination, you can show the rule, the log entry and the notification instead of digging through old tickets.
Notifications can include the before-and-after values for every change, and can go to a ticketing address so your service desk keeps a record automatically.
The cost of waiting
Offboarding gaps rarely look urgent until something goes wrong: a former employee opens a shared drive, a license keeps billing for months, or an audit finding lands on the security team’s desk. Automating the process takes the human handoff out of the equation, and it’s one of the fastest wins an IT team can deliver.
Want to see a termination flow from UKG to Active Directory in real time? Book a demo or start a free trial.
