Offboarding a member¶

When someone leaves, removing them from your identity provider is not enough, and neither is removing their AppGantry membership on its own. Credentials in AppGantry belong to different owners — some to the person, some to the project, some to the organization — so they have to be cleared separately.

1. Remove them from your identity provider¶

What deprovisioning in your IdP actually does

Removing someone in your identity provider stops them signing in via SSO. It does not remove their AppGantry membership, end an existing session, or revoke a personal access token, a project access token, or any other credential they hold. Treat it as one step, not the whole job.

If you are using SSO, then as long as your provider exists, and they have access, they'll be able to sign in and get access (depending on how your org is configured). Remove them from SSO first.

See SSO.

2. Remove the membership¶

Remove the person from every organization they belong to. This is the step that actually withdraws authorization: role checks run per request, so a removed member stops being able to act on the organization even if they still hold a valid session cookie.

Removing a member does not delete the things they created — builds, channels, testers, and project access tokens all belong to the project or organization, not to the person.

See Organizations & members.

3. Rotate project access tokens they could have read¶

A project access token belongs to the project, not to the person who minted it. Removing a member leaves every project token they created — or simply saw — fully live.

Assume any token value the departing member had access to is compromised: mint a replacement, update the CI secret that uses it, and revoke the old one.

See CI with project access tokens.

4. Rotate shared credentials they had access to¶

Anything the organization holds as a shared secret needs the same treatment if the person could read or configure it:

Webhook signing secrets. Rotate the secret on each subscription they could see. See Webhooks.
BYOSA storage access. If the person administered your Azure tenant, review the role assignment on the container. See BYOSA setup.

5. Check the audit trail¶

Read the audit feed for the period around the departure. It records membership changes, token creation and revocation, sign-ins, and settings changes, so it is the fastest way to find a credential you forgot about.

See Audit events.