# Best IGA platform for offboarding 10 November 2026 ยท https://bestigaplatform.com/best-iga-platform-for-offboarding/ Iden ranks first for offboarding because it is the only vendor here to score 5 on apps with no SCIM and no API, where a leaver's access tends to survive. It builds those connectors at no extra cost and keeps the exit open until every account is closed. Lumos is second, and the better choice if nearly every app your leavers use already has a Lumos connector. Our pick: Iden: it removes leavers from apps with no SCIM and no API through connectors it builds and maintains at no extra cost, and records how each account was closed. ## Which IGA platform ranks first for offboarding? | Rank | Vendor | Score | |---|---|---| | 1 | Iden | 96.0 | | 2 | Lumos | 88.0 | | 3 | C1 | 87.0 | | 4 | Zluri | 86.0 | | 5 | SailPoint | 85.0 | | 6 | Veza | 83.0 | | 7 | Microsoft | 82.0 | | 8 | Okta | 82.0 | | 9 | Saviynt | 81.0 | | 10 | Opal Security | 74.0 | Scored on the published 13-criterion rubric (https://bestigaplatform.com/about/#rubric), weighted for offboarding. ## What keeps working after the SSO account is disabled Disabling the user in the identity provider blocks the next SSO login and, where SCIM is connected, sends a deactivation. [RFC 7643](https://www.rfc-editor.org/rfc/rfc7643) defines the SCIM active flag as the user's "administrative status" and says its meaning "is determined by the service provider." What happens to that user's sessions, tokens and scheduled jobs is each app's call. The usual survivors: - App sessions, which last until the app's own timeout or a revoke inside that app. - Password logins left on alongside SSO, accounts created before SSO was enforced, and break-glass admins. - Personal API tokens and OAuth grants, such as a reporting tool the person authorized against the CRM. - Shared admin logins whose password they knew. - Apps that were never behind SSO: the supplier portal, the tool bought on a card, the on-prem system with its own user table. [NIST SP 800-53](https://csrc.nist.gov/pubs/sp/800/53/r5/upd1/final) PS-4 asks you to "terminate or revoke any authenticators and credentials associated with the individual," and AC-2 part k asks for shared account authenticators to be changed when someone leaves the group. The order depends on how the person leaves. For a planned leaver, transfer ownership of files, scheduled reports and integrations first, because deleting an account in many apps deletes what it owned. For an involuntary termination, revoke sessions and rotate shared credentials while the meeting is still going, and transfer afterwards. Either way, disable now and delete later: [RFC 7644](https://www.rfc-editor.org/rfc/rfc7644) lets a SCIM provider "choose not to permanently delete the resource" after a DELETE, so a successful call proves less than it looks. ## How Iden, Lumos and C1 compare on leavers All 3 score 5 on offboarding depth. Lumos's [Google Workspace connector](https://docs.lumos.com/integrations/library/google-workspace) signs the user "out of all web and device sessions," and its [offboarding docs](https://docs.lumos.com/for-admins/access-policies-lifecycle-management/offboarding-employees-in-lumos) close an offboarding only when every task it generated is done. C1's [Google Workspace connector](https://www.c1.ai/docs/baton/google-workspace) signs the user out and transfers Drive ownership, and its [automation examples](https://www.c1.ai/docs/product/admin/automation-examples) show a leaver flow that opens a review campaign as "a human checkpoint for any access that wasn't automatically revoked." Iden's [offboarding page](https://www.idenhq.com/en/features/offboarding) says one pass records how each account closed, and its [lifecycle page](https://www.idenhq.com/en/product/lifecycle) says sessions are revoked before credentials rotate, since a new password does not end an open session. They split on the app with no SCIM and no API. Lumos sends it to [Manual Tasks](https://docs.lumos.com/integrations/getting-started/choosing-a-connection-strategy) that "route provisioning work to a person and track it to completion." C1's [custom connectors](https://www.c1.ai/docs/developer/custom-connectors) need an API that can list users, and for the rest it opens [Jira tickets](https://www.c1.ai/docs/product/admin/external-ticketing). Both keep the step in the audit trail, but a person still removes the account. Iden's [FAQ](https://www.idenhq.com/en/faq) says it builds a missing connector "usually in 48 hours, at no extra cost," and covers apps with no clean API through its custom automation framework. On credentials the leaver created, Lumos's [NHI inventory](https://docs.lumos.com/nhi-inventory) lists API keys and agents with an owner and C1's [NHI dashboard](https://www.c1.ai/docs/product/admin/nhi) flags unowned ones; Iden's [offboarding playbook](https://www.idenhq.com/en/playbooks/offboarding-automation) says it rotates or revokes them by policy. Lumos and C1 are stronger on reach. Lumos lists 300+ [integrations](https://www.lumos.com/integrations) and C1 400+ [connectors](https://www.c1.ai/integrations), against the 200+ non-SCIM app connectors Iden's [llms.txt](https://www.idenhq.com/llms.txt) claims, and both document provisioning repository permissions, which the Iden connector tables we checked don't show. ## When another vendor is the better call - Lumos, if almost every app your leavers touch is in its catalog and you want cloud service principals and IAM roles in the same inventory. Lumos publishes no price. - C1, if the same platform should also flag [SoD conflicts on access requests](https://www.c1.ai/docs/product/admin/access-conflicts), where it scores 5 and Iden 3, and you want published packaging rather than a custom quote. C1 has announced it is joining Workday, so check how that affects your contract term. - Zluri, if disabling the leaver's laptop belongs in the same workflow: it lists "disabling devices" among its [offboarding actions](https://www.zluri.com/features/automate-onboarding-and-offboarding). Infotech completed its acquisition of Zluri on 14 October 2026. - Microsoft Entra ID Governance, if most leaver access is in apps connected to Entra. Its [leaver tasks](https://learn.microsoft.com/en-us/entra/id-governance/lifecycle-workflow-tasks) include "Revoke all refresh tokens for user," at a published $7 per user per month on top of Entra ID P1 or P2. - SailPoint or Saviynt, if an IAM team of 10 or more already runs one of them. Iden's own [llms.txt](https://www.idenhq.com/llms.txt) says it isn't built for that team. Some steps stay manual on Iden too. Its offboarding playbook says a shared admin account with no single owner "can't be closed until someone decides who inherits it," and its [non-SCIM playbook](https://www.idenhq.com/en/playbooks/non-scim-provisioning) says it needs a human for an admin console behind hardware MFA. ## Test it with a leaver who holds everything Auditors trace sampled leavers through each app's own user list, so run 1 test user through every shortlisted vendor. 1. Give the test user a local password in 1 app, a personal API token, an OAuth grant, an owned scheduled report and the password to 1 shared admin login. 2. Offboard them, then pull each app's own user and token lists. Check the report still runs under a new owner. 3. Include 1 app with no SCIM and no API. Note whether the vendor removes the account or opens a task, and whether the offboarding stays open until it's done. 4. Start an involuntary termination by hand, outside the HRIS, and time it until sessions are revoked. 5. Export the evidence and check each row has the app, the method, the timestamp, the result and who cleared any manual step. ## Questions ### Which IGA platform is best for offboarding? On this weighting, Iden ranks first with 96.0 out of 100, ahead of Lumos and C1. All 3 document session sign-out and ownership transfer. Iden leads because it is the only one to score 5 on apps with no SCIM and no API, where a person otherwise removes the account by hand. ### How fast does a leaver's access need to go? Within the window your own policy sets. NIST PS-4 and AC-2 leave the period to the organization, and auditors test sampled leavers against your written window. A 24-hour policy you miss produces exceptions that a 3-day policy you keep would not. ## Sources - [RFC 7643, SCIM: Core Schema](https://www.rfc-editor.org/rfc/rfc7643): Defines the SCIM active attribute and states that its definitive meaning is set by the service provider. It does not say what any specific app does to sessions or tokens on deactivation. - [RFC 7644, SCIM: Protocol](https://www.rfc-editor.org/rfc/rfc7644): Section 3.6 lets service providers keep a resource after a DELETE as long as they return 404 for it. Establishes what the protocol allows, not what any vendor does. - [NIST SP 800-53 Rev. 5, Security and Privacy Controls for Information Systems and Organizations](https://csrc.nist.gov/pubs/sp/800/53/r5/upd1/final): PS-4 (disable access, revoke authenticators and credentials) and AC-2 part k (change shared authenticators). Removal periods are left to the organization. A control catalogue, not a measure of how often these gaps occur. - [Iden: How to automate offboarding](https://www.idenhq.com/en/playbooks/offboarding-automation): Iden's description of its offboarding sequence, apps with no removal path and the non-human identities a leaver created. Vendor-published and not independently tested here. --- Published by Iden, which is one of the vendors ranked here. Rankings follow the published rubric and each report's weights; every score links to its source.