Skip to main content
Offboard a person when they leave the organization or no longer need Atlan. Organization removal, identity-provider access, and service credentials have separate effects. Verify each before closing the handover.

Before you begin

You need the Admin organization role to remove a member. Promote another admin first if the person is the last admin. Arrange ownership of shared skills, workspaces, and workloads before removing access. Review the Offboarding setting in Authentication. A departing person’s API keys can be used by shared workloads. Replace those credentials and test the replacements before disabling them.
1

Disable identity-provider access

Remove the person’s access to the Atlan application in your identity provider when they should no longer sign in through it. For directory-managed membership, make the change in that directory and allow synchronization to complete.Removing someone in Atlan Trident does not disable their identity-provider account. Review other enabled sign-in methods and the organization’s joining rules as well.
2

Remove organization membership

Open Settings → Organization → Members. Find the person, open their row’s action menu, and select Remove from organization. Review Remove from organization? and select Remove.This removes their organization role and organization-root workspace membership. Background membership synchronization can also withdraw their remaining workspace and group access. It can take time to finish. The same background cleanup revokes the pending invitations the person sent.Removing a member here suspends their membership. It doesn’t end their existing sessions or agent consents. Removing them in an identity provider that syncs its directory to Atlan Trident does end both.
3

Review credentials

Open Settings → Organization → API keys and review the credentials the departing person created. Background departure cleanup retires their registered service accounts, but a successful roster removal does not prove that every credential has finished cleanup.Revoke any credential that is still active and no longer authorized. See Revoke an API key. Check shared workloads before removing their old secret values.
4

Verify workspace cleanup

Have workspace admins review the person’s direct and group-based access in each shared workspace. Remove any remaining grant that should no longer apply. See Manage workspace members and Manage groups.Verify that shared workspaces still have an active admin. Departure cleanup can assign the remaining organization admins where the departing person was the sole shared-workspace admin.
5

Verify access removed

Refresh Members, the affected workspace access lists, and credential status. Review the audit log for recorded removals and credential changes. The invitations that cleanup revoked appear on Changes only when Show automated activity is on.A person disappearing from Members does not by itself establish that all existing sessions or delegated consents were revoked. Confirm the organization’s offboarding outcome with your administrator when these need to be ended immediately.

Troubleshooting

If removal is refused because the person is the last admin, promote another member and retry. If their workspace access remains, review direct grants and group membership after synchronization; see Workspace access errors. If directory-managed access returns after a local change, update the directory assignment before retrying. Do not repeatedly remove a person while the source continues to grant access.

See also