Connecting the ERP to the automation, and the offboarding gap it exposed

Wiring the ERP into the onboarding script through its API, auditing every user, and finding people who were only partly offboarded.

This week I connected our enterprise resource planning system, an ERP, into the onboarding automation through its API, and the audit that followed found real security debt.

The ERP is where business truth lives, customers, invoices, permissions. Getting the automation to talk to it through the API meant a new hire no longer needed a manual step in that system, so the script matured from "most of the setup" to "the setup." Then I ran the obvious follow-up: I audited all two hundred and five users across the ERP. Twenty-six of them were disabled in Microsoft 365 but still enabled in the ERP. Only four of the customer service reps had the newer, tighter permission set. That is the kind of drift that builds up when each system is managed a little separately.

The second finding was worse. I identified four departed staff who had been only partly offboarded: their directory accounts still enabled, their identity provider accounts still active for three of them, and no deactivation case on file for two. I raised it with their supervisors before changing anything, because offboarding real people is not something you do quietly on a hunch. But the gap was exactly the kind of thing an auditor would find and an attacker would love.

I closed fifty-three tickets that week, including sixteen email-security reviews, so it was a full week on top of the project work. But the reconciliation is the headline.

The lesson is the control that matters: cross-system reconciliation. Offboarding is not done when the main account is disabled. It is done when every system agrees the person is gone. The only way to know that is to compare systems against each other on purpose, on a schedule, and to act on the mismatches. Same instinct as an access review, pointed at employee lifecycle.

Wire the systems together. Then keep asking whether they still agree.

← All writing · Portfolio