> For the complete documentation index, see [llms.txt](https://docs.peig.io/llms.txt). Markdown versions of documentation pages are available by appending `.md` to page URLs; this page is available as [Markdown](https://docs.peig.io/welcome-to-peig-documentation/admin-guide/offboarding.md).

# Offboarding

When a user leaves the organisation, their access must be revoked promptly. Suspending an account takes effect immediately across all devices and services — with no delay and no risk of residual access.

## Offboarding a user

1. Open the user's profile in **Users & Access**
2. Click **Suspend User**

The user is immediately blocked from accessing any service from any of their registered devices. Their account and device records are preserved.

{% hint style="success" %}
Suspension is immediate. There is no delay, no token expiry to wait for, and no risk of the user retaining access after this step.
{% endhint %}

## SAML applications — additional steps required

{% hint style="warning" %}
Suspending a user in Peig blocks authentication through Peig. However, for SAML-only applications (secondary providers), the user's account in the application itself is managed independently — Peig has no provisioning connection to remove or deactivate it.

After suspending the user in Peig, you must also **manually remove or deactivate the user's account in each SAML application** to ensure no residual access remains. This may include archiving the user in the application if required by your retention policy.
{% endhint %}

This does not apply to Microsoft 365 or Google Workspace, where user lifecycle is managed through their respective admin consoles as part of your normal offboarding process.

## Offboarding contractors and temporary users

The same process applies for contractors and temporary staff. To avoid forgotten access, note the expected end date when you create a contractor's account and set a calendar reminder to suspend them on that date. Remember to also remove their accounts from any SAML applications they had access to.

## What happens after suspension

* The user's Peig app will no longer have access to the workspace
* All connected services will deny authentication requests from the user's devices
* For federated services like Microsoft 365, sign-in attempts are rejected at the Peig layer before reaching Microsoft
* For SAML applications, authentication via Peig is blocked — but the user's account in the application must be removed manually

## Coming soon

{% hint style="info" %}
An **archive** feature is in development. This will allow you to formally close and archive user accounts while retaining a record of their access history for audit purposes.
{% endhint %}