The Offboarding Gap: Removing Leavers From Every Group in Every Tool

Most companies have an offboarding checklist, and most of it works. The laptop comes back. The Google account is suspended. Slack is deactivated. Payroll stops.

What usually doesn't happen is the long tail: the GitHub team that still lists the person, the Jira group that grants them access to a restricted project, the PagerDuty schedule they're still on, the Opsgenie team, the Zoom group, the Linear team, the private Slack channel that a manager created and forgot. Some of these are harmless leftovers. Some keep working credentials pointed at real systems.

And the case that's even more often missed isn't leavers at all. It's movers — people who change teams and keep every group membership they had before.

This post is about the gap between "the account is deactivated" and "the person is out of every group", and how to close it.

Why deactivation doesn't cover it

Deactivation in one tool does different things in each tool, and in most of them it doesn't touch group memberships elsewhere.

Google Workspace. Suspending a user blocks sign-in and new mail but keeps their data. Google's own admin guidance recommends removing suspended users from groups as part of a termination process, and warns that a group's messages bounce automatically when more than 66% of its members are suspended. Suspended accounts are also still billed at the same rate as active ones (Google Workspace admin help, 2026). Unless a script or tool filters on member status, anything that reads Google Group membership will keep treating a suspended user as a member until they're removed.

Slack. Deactivating an account removes the person from all channels and signs them out everywhere (Slack help center, 2026). That's strong for leavers. It doesn't help movers, who are still active.

Atlassian. With Atlassian's free Google Workspace connection, you deactivate accounts manually. Automatic deactivation when a Google account is suspended, archived or deleted requires Atlassian Guard Standard (Atlassian documentation, 2026).

GitHub. Engineers usually use personal GitHub accounts. Leaving your company doesn't deactivate that account; it has to be removed from your organization and its teams. If you're on GitHub Enterprise Cloud with SSO, your IdP setup may handle part of this. If not, it's manual.

PagerDuty and Opsgenie. A leaver still on a schedule is a coverage gap — their shifts page someone who won't answer. Reassign their shifts and remove them from teams before you remove their account.

So the leaver ends up in one of three states per tool: cleanly removed, deactivated but still listed in groups, or fully active because nobody touched that tool.

Movers are the bigger problem

When someone leaves, at least there's a ticket. When someone moves from support to sales engineering, there's usually an announcement, a new manager, and a request for new access. Almost nobody files a request to remove the old access.

The result: people accumulate group memberships from every team they've been on. A three-year employee might sit in five team channels, three GitHub teams and a Jira group for a project that ended two reorgs ago. Each one is a small access leak, and together they make access reviews painful because the groups no longer describe teams. More on that in group membership drift and access reviews.

The fix: make removal a consequence of one change

The pattern that closes the gap is the same one that fixes onboarding:

1. One source group per team in the directory (Google Groups or Microsoft Entra ID).
2. Every downstream group follows its source — Slack user groups and channels, GitHub teams, Jira groups, PagerDuty and Opsgenie teams, Zoom, Linear.
3. Removal is a sync, not a checklist. Remove someone from platform@ and they're removed from every group that follows platform@.

With that in place, a mover is one change (take them out of support@, add them to platform@) and a leaver is the same change plus account deactivation.

The step-by-step setup for the "add" side is in Employee onboarding: get new hires into the right groups on day one. For offboarding specifically, a few details matter.

Setting it up with SyncMyGroup

SyncMyGroup adds and removes members so each destination matches its source, and creates or deletes destination groups as needed. For offboarding:

Make every team group a source. For each team, create syncs from the directory group to each tool where that team has a group. The workflow list shows supported pairs, such as Google Group → Slack, Google Group → GitHub, Google Group → Jira and Google Group → PagerDuty.

Read the first preview as an audit. The first time you preview a sync against an existing, hand-maintained group, the removals list is every leaver and mover nobody cleaned up. Review it with the team lead before activating. This is often the most useful output of the whole project.

Use permanent users sparingly. Permanent users stay in a group regardless of the source. They're right for a service account or a manager in a leadership channel. Every permanent user is someone offboarding won't remove automatically, so keep a list and review it.

Subscribe a channel to changes. Run @SyncMyGroups subscribe <team> in an IT or security channel (Slack or Microsoft Teams). Every removal shows up as a message, which gives you a running record alongside SyncMyGroup's audit logs of sync operations.

Remove suspended users from source groups. Because a suspended Google user is still a group member, make "remove from all groups" part of your Google suspension step — Google's own guidance says the same. Once they're out of the source groups, the syncs remove them downstream.

An offboarding runbook that fits on one page

Step	Where	Automated by group sync?
Reassign on-call shifts	PagerDuty / Opsgenie / JSM	No — do this first
Remove from all team groups	Google Groups or Entra ID	This is the trigger
Removed from Slack user groups and synced channels	Slack	Yes
Removed from GitHub teams	GitHub	Yes
Removed from Jira / Atlassian groups and teams	Atlassian	Yes
Removed from PagerDuty / Opsgenie teams, Zoom, Linear, GitLab	Each tool	Yes, where synced
Check notifications for each removal	IT channel	—
Remove from GitHub organization	GitHub	No — org membership is separate
Deactivate Atlassian account	Atlassian admin	No, unless you use Guard Standard
Deactivate Slack account	Slack	No, unless your IdP does it
Suspend or delete Google account	Google Admin	No
Review permanent-user list	SyncMyGroup	Periodically

Group sync handles the middle of the table — the part that's tedious, spread across many tools, and most often skipped. Accounts are still a separate step.

Movers: the runbook is one line

For a team change, the runbook is: move them between directory groups. The syncs add the new team's groups and remove the old team's. If someone needs to keep temporary access to their old team during a handover, add them to the old team's destination as a permanent user and set a reminder to remove it.

Proving it worked

Auditors and security reviewers will ask how you know a leaver lost access. Useful evidence:

• The notification messages in your subscribed channel, timestamped, per removal.
• SyncMyGroup's audit logs of sync operations.
• A current preview for each sync showing no pending changes.

That's a much shorter conversation than "we have a checklist and we think people follow it".

Pricing

Free up to 5 users with every integration. Starter is $2 per user per month with unlimited users, API access and reporting (pricing). SyncMyGroup is ISO/IEC 27001:2022 certified, encrypts data with AES-256 at rest and TLS 1.3 in transit, and stores only email addresses and OAuth integration data.

FAQ

Doesn't deactivating someone in Slack remove them from everything?

It removes them from all Slack channels, according to Slack's help center. It doesn't affect Google Groups, GitHub teams, Jira groups or on-call tools, and it doesn't help when someone changes teams and stays active.

Are suspended Google Workspace users removed from groups?

They remain members until they're removed. Google's guidance recommends removing suspended users from groups as part of termination, and messages to a group bounce once more than 66% of its members are suspended.

What about people who change teams?

Movers are where access piles up. If every downstream group follows a directory group, moving the person between directory groups handles both the additions and the removals.

Does group sync deactivate accounts?

Treat them as separate jobs. Group sync is about group and team membership; deactivating or deleting accounts in each tool belongs in its own offboarding step, handled by your IdP, SCIM, or an admin.

---

Want to know how many leavers are still in your groups? Connect your tools at app.syncmygroup.com and read the preview, or book a walkthrough.