When an employee leaves your organization, update their status to Resigned in the SASE console so that security policies revoke the former employee's access to corporate resources immediately. This tutorial shows you how to configure the offboarding workflow for each supported identity source type.
Choose your identity source
SASE supports multiple identity source types, and the offboarding workflow varies by type. Use the following table to pick the path that matches your identity source, then follow the corresponding section.
Identity source | Synchronization method | Configuration required | Trigger | Edition and region |
DingTalk | Event subscription push | Configure event subscription in the DingTalk Developer Platform | Remove the employee from the DingTalk admin console | All editions and sites |
Lark | Event subscription push | Configure event subscription in the Lark Open Platform | Remove the employee from the Lark admin console | All editions and sites |
IDaaS New Version | Account synchronization callback | Configure account sync callback in the IDaaS console | Delete the employee in the IDaaS console | All editions and sites |
Custom IdP | Manual operation | No third-party configuration | Update the status in the SASE Employee Center | All editions and sites |
How the mechanism works varies by identity source:
DingTalk and Lark (Feishu) — Event subscription pushes employee departure events from the third-party platform to SASE in real time, which triggers the corresponding security policy update.
IDaaS (new version) — Account synchronization between the IDaaS console and SASE propagates account deletions.
Custom identity source — You update the employee status manually in the SASE console. No third-party integration is needed.
If your organization already runs on DingTalk, Lark, or IDaaS, use event subscription or account synchronization so that departure events propagate automatically.
If you use a directory service that SASE does not integrate with directly, choose the Custom identity source path and update the status manually.
Prerequisites
Before you begin, ensure that you have:
Activated SASE and have administrator access to the SASE console.
Configured the identity source in SASE. For instructions, see the following topics:
For a DingTalk identity source: administrator access to the DingTalk Developer Platform, and permission to grant the application address book permissions in DingTalk.
For a Lark (Feishu) identity source: administrator access to the Lark Open Platform, and permission to grant the application both application-identity and user-identity permissions.
For an IDaaS (new version) identity source: administrator access to the IDaaS console and permission to configure Provisioning for the Alibaba Cloud SASE application.
Configure offboarding for a DingTalk identity source
Configure event subscription in both the SASE console and the DingTalk Developer Platform to enable automatic employee departure synchronization.
Step 1: Obtain configuration URLs from the SASE console
Log on to the SASE console .
In the left-side navigation pane, choose Identity Authentication > Identity Access.
Click the Identity synchronization tab.
Click Edit of an existing DingTalk identity source to edit it.
On the basic configuration page, copy the following URLs. You will need them when you configure the DingTalk application:
Field
Where to paste in the DingTalk Developer Platform
Copy Request URL
Application Development > Enterprise Internal Applications > your application > Development Configuration > Event Subscription > Request URL
Copy Application Homepage Address
Application Development > Enterprise Internal Applications > your application > application homepage address
Copy Callback Domain Name
Development Configuration > Security Settings > Redirect URL (Callback Domain) and Share Settings > Callback Domain Name
Step 2: Create and configure an application in the DingTalk developer platform
Log on to the DingTalk Developer Platform.
Choose Application Development > Enterprise Internal Applications and create an application.
On the Permission Management page, grant the application the required address book permissions so that SASE can read organizational structure changes.
Navigate to Development Configuration > Event Subscription and paste Request URL that you copied from the SASE console into the Request URL field.
ImportantEnable the event subscription permissions for organizational change events, including employee departure. Without these permissions, SASE cannot receive departure notifications.
Navigate to Development Configuration > Security Settings and paste the callback domain name from the SASE console into the Redirect URL (Callback Domain) field.
Navigate to Share Settings and paste the callback domain name into the Callback Domain Name field.
Step 3: Configure event subscription parameters in SASE
Return to the SASE console and navigate to the DingTalk identity source configuration page.
Click Advanced Settings to expand the advanced configuration section.
In the Event Subscription area, configure the following parameters:
Parameter
Description
AES Encryption Key
Enter the AES encryption key obtained from the DingTalk Developer Platform. Maximum length: 64 characters. Only digits and letters are allowed.
Encryption Token
Enter the encryption token obtained from the DingTalk Developer Platform. Maximum length: 64 characters. Only digits and letters are allowed.
Save the identity source configuration.
Step 4: Publish the application and trigger a test departure
In the DingTalk Developer Platform, publish the application.
In the DingTalk Admin Console, remove an employee from the organization.
Verify the status update in the SASE console. For instructions, see Verify employee offboarding status.
Configure offboarding for a Lark identity source
Configure event subscription in both the SASE console and the Lark Open Platform to enable automatic employee departure synchronization.
Step 1: Obtain configuration URLs from the SASE console
Log on to the SASE console .
In the left-side navigation pane, choose Identity Authentication > Identity Access.
Click the Identity Synchronization tab.
Click Add Identity Source to create a Lark identity source, or click the name of an existing Lark identity source to edit it.
Click Advanced Settings to expand the advanced configuration section.
In the Event Subscription area, copy the Request URL. You will paste this URL in the Lark Open Platform.
On the identity source configuration page, copy the redirect URL.
Step 2: Create and configure an application in the Lark open platform
Log on to the Lark Open Platform.
Create an enterprise self-built application.
On the application details page, obtain the App ID and App Secret. Enter these values in the SASE console when you configure the Lark identity source.
Add the Web Application capability to the application and configure the application URL based on your SASE environment.
On the Permission Management page, grant the permissions required for both the application identity and the user identity.
Configure events and callbacks: a. Set the subscription mode to Developer Server. b. Paste the request URL that you copied from the SASE console into the Request URL field. c. Subscribe to the employee departure event. d. From the encryption strategy section, record the Encrypt Key and Verification Token values.
In the Security Settings section, add the redirect URL that you copied from the SASE console.
Step 3: Configure event subscription parameters in SASE
Return to the SASE console and navigate to the Lark identity source configuration page.
Click Advanced Settings to expand the advanced configuration section.
In the Event Subscription area, configure the following parameters:
Parameter
Description
Encrypt Key
Enter the Encrypt Key obtained from the Lark Open Platform event subscription page. Maximum length: 64 characters. Only digits and letters are allowed.
Verification Token
Enter the Verification Token obtained from the Lark Open Platform event subscription page. Maximum length: 64 characters. Only digits and letters are allowed.
Save the identity source configuration.
Step 4: Publish the application and trigger a test departure
In the Lark Open Platform, publish the application.
NoteSet the availability scope to All Employees so that departure events for all employees are pushed to SASE.
In the Lark admin console, remove an employee from the organization.
Verify the status update in the SASE console. For instructions, see Verify employee offboarding status.
Configure offboarding for an IDaaS (new version) identity source
Configure account synchronization between the IDaaS console and SASE to enable automatic employee departure synchronization.
Step 1: Configure the IDaaS identity source in the SASE console
Log on to the SASE console.
In the left-side navigation pane, choose Identity Authentication > Identity Access.
Click the Identity Synchronization tab.
Click Add Identity Source to create an IDaaS (new version) identity source, or click the name of an existing IDaaS identity source to edit it.
On the basic configuration page, copy the URL for Receiving Synchronization Requests.
NotePaste this URL on the Provisioning page of the SASE application in the IDaaS console. To go to the Provisioning page, click Applications in the left-side navigation pane of the IDaaS console and click the ID of the Alibaba Cloud SASE application.
Optionally, configure the Encryption/Decryption Key to encrypt the synchronization data. Maximum length: 128 characters. Only digits and letters are allowed.
Save the identity source configuration.
Step 2: Configure account synchronization in the IDaaS console
Log on to the IDaaS console.
In the left-side navigation pane, click Applications. Find and click the Alibaba Cloud SASE application.
On the application details page, click the Provisioning tab.
Paste the URL for URL for Receiving Synchronization Requests that you copied from the SASE console.
Enable the callback events for employee account deletion.
Save the configuration.
Step 3: Trigger a test departure
In the IDaaS console, delete an employee account.
Verify the status update in the SASE console. For instructions, see Verify employee offboarding status.
Configure offboarding for a custom identity source
For custom identity sources, manually update the employee status in the SASE console. No third-party platform configuration is required.
Step 1: Update the employee status in the SASE console
Log on to the SASE console.
In the left-side navigation pane, choose Identity Authentication > Identity Access.
Click the Employee Center tab.
Find the employee that you want to mark as resigned.
In the Actions column, click Edit.
In the edit panel, set Employment Status to Resigned.
Click OK to save the changes.
Configure offboarding cleanup policy
The offboarding cleanup policy is a global policy that applies to all identity sources. You can configure when to automatically delete user data and stop logging after an employee is offboarded.
Log on to the SASE console . In the left-side navigation pane, choose Identity Authentication > Identity Access.
Click the Employee Center tab.
In the upper-right corner of the page, click Offboarding Cleanup Policy.
In the Offboarding Cleanup Policy dialog box, configure the following parameters.
Parameter
Description
Anti-Uninstall Release for Offboarded Users
Specifies whether to automatically release the anti-uninstall protection on the endpoint after an employee is offboarded. By default, this feature is disabled.
After Offboarding [N] Days to Auto-Delete Users
The number of days after offboarding before the user data is automatically deleted. Valid values: 1 to 30. Default value: 1.
After Offboarding [N] Days to Stop Logging
The number of days after offboarding before logging stops for the user. Valid values: 1 to 30. Default value: 1. This value cannot exceed the value of After Offboarding [N] Days to Auto-Delete Users.
NoteThe stop logging time cannot be later than the automatic user deletion time. If you set After Offboarding [N] Days to Stop Logging to a value greater than After Offboarding [N] Days to Auto-Delete Users, an error message is displayed.
Click OK to save the policy.
Verify employee offboarding status
After you trigger the departure in the third-party platform (or update the status manually for a custom identity source), verify the status update in the SASE console:
Log on to the SASE console.
In the left-side navigation pane, choose Identity Authentication > Identity Access.
Click the Employee Center tab.
In the left pane, select the identity source from the dropdown list.
Search for the employee by username, email, or phone number.
Check the Employment Status column. The following statuses are available:
Status | Description |
Employed | The employee is currently active in the organization. |
Pending Resignation | The employee is marked for resignation but the process is not yet complete. |
Resigned | The employee has left the organization. This status is displayed in gray. |
You've successfully offboarded the employee when the Employment Status column displays Resigned.
For DingTalk, Lark, and IDaaS identity sources, the status update depends on correct event subscription or account synchronization configuration. If the status does not update after the employee is removed from the third-party platform, check the following:
The event subscription or callback is correctly configured in both the SASE console and the third-party platform.
The third-party application is published and active.
The identity source is enabled in the SASE console.