How does it decide which employees count as "inactive"?

The threshold is configurable (default: 30 days). The query returns employees whose last IdP login is older than that many days, plus employees who have never logged in at all. Service account inclusion is also configurable.

What does it handle and what does it hand off to a human?

Both workflows handle detection, reporting, ticket creation, and notification automatically. All remediation (deactivating accounts, recovering assets, investigating why an account is dormant) is left to IT via the ticket. Harmony doesn't take action on accounts or assets - it surfaces the problem and tracks it.

Will it keep creating tickets for the same accounts every day?

No. Both workflows include a frequency gate (default: 7 days) that filters out employees or assets already reported within that window. A new report is only generated if the frequency window has passed - so an account flagged on Monday won't appear again until at least the following Monday.

What does it need to be connected to before it works?

An IdP integration (Okta, Entra, etc.) must be configured and syncing login data. The assets workflow additionally requires the Asset Management module to have device assignments. Both workflow templates must be explicitly enabled per tenant (disabled by default).

All agents

Inactive Employees

Detects inactive employee accounts and drives remediation through automated suspension and manager notification

Book a demo How it works

Works with

One run, end to endResolved

1Runs periodic checks on employee login activity across identity systems
2Flags accounts that have been inactive beyond the configured threshold
3Distinguishes newly inactive accounts from those already being tracked
4Notifies managers about their inactive direct reports
5Opens a ticket for review and potential suspension
6Auto-resolves once account activity resumes

Overview

What Inactive Employees does

Inactive Employees is Harmony's dual-workflow monitoring system for detecting and surfacing employees who have gone dormant in the identity provider, and the company-owned assets still assigned to them. Two complementary scheduled workflows run on configurable cadences: one finds employees whose last IdP login exceeds a threshold and creates a CSV-backed IT ticket, and a second cross-references those inactive accounts with asset management to surface devices that may be sitting idle or at risk of being lost. IT teams start each week knowing exactly who has drifted out of activity and what hardware is tied to those accounts.

Who it's for

Who Inactive Employees Is For

Persona

IT operations teams responsible for identity hygiene, account governance, and asset lifecycle management.

Pain point

Inactive accounts represent a security risk (stale credentials) and a compliance concern (unused licenses). Assets assigned to inactive employees may be unreturned, untracked, or at risk. Without automated monitoring, IT has no proactive way to detect either problem until something goes wrong - these workflows surface both automatically.

How it works

Workflow 1: Inactive Employees in IdP (Daily)

Trigger

A cron schedule fires (default: daily at 8 AM UTC).

1
Query inactive employees
The workflow queries the IdP for all employees whose last login exceeds the configured inactivity threshold (default: 30 days). Employees who have never logged in are also included. Optionally includes service accounts.
2
Frequency filter
Employees already reported within the re-reporting window (default: 7 days) are filtered out to avoid duplicate tickets on the same accounts.
3
CSV report
All newly flagged inactive employees are serialized into a CSV report.
4
Ticket creation
A ticket titled "Inactive Employees Detected in IdP" is created in the IT desk with the CSV attached.

Outcome

The ticket assignee (or desk managers if unassigned) is notified via Slack or Teams.

How it works

Workflow 2: Assets Assigned to Inactive Employees (Weekly)

Trigger

A cron schedule fires (default: weekly, Monday at 8 AM UTC).

1
Query inactive employees
Same IdP inactivity query as Workflow 1.
2
Cross-reference with assets
For each inactive employee, the workflow fetches their company-owned assets from asset management.
3
Frequency filter
Assets already reported within the re-reporting window are filtered out.
4
CSV report + ticket
A ticket titled "Assets Related to Inactive Employees" is created with the CSV attached and the related asset IDs linked, so IT can take direct action on each device.

Outcome

Assignee or desk managers are notified.

Capabilities

IdP inactivity detection

Identifies employees whose last login to the identity provider exceeds a configurable threshold (default: 30 days), including accounts that have never logged in.

Service account inclusion

Configurable option to include or exclude service accounts from the inactivity query.

Asset cross-referencing

For each inactive employee, fetches all company-owned assets assigned to them so IT can see what hardware is tied to dormant accounts.

Frequency-gated re-reporting

Tracks when each employee or asset was last reported and suppresses re-reports within the configured window (default: 7 days), preventing ticket spam on the same accounts.

CSV export

Generates structured CSV reports for both inactive employees and their associated assets, attached to tickets for bulk review and action.

Asset-linked tickets

The assets ticket includes related asset IDs so IT can navigate directly to affected devices in the asset management system.

Configurable schedule

Each workflow's cron schedule and timezone are independently configurable per tenant.

Smart notification routing

Notifies the configured ticket assignee; falls back to desk managers if no assignee is configured, avoiding silent ticket creation.

Use cases

Main use cases

Weekly Identity Hygiene Audit

IT wants to ensure no employee accounts remain active in Okta after more than 30 days without a login - a common compliance requirement. The daily workflow queries the IdP, filters accounts that have already been reported this week, creates a ticket with the full CSV, and notifies the IT desk - automatically, every day. IT works through the list and takes action on each account.

Recovering Assets From Inactive Employees

IT suspects that several laptops are assigned to employees who haven't logged in for months. They need to identify and recover those devices. The weekly assets workflow cross-references inactive employees with asset management, finds all company-owned devices tied to those accounts, and creates a ticket with the asset list and a CSV. IT sees exactly which assets need to be recovered and from whom.

Compliance Reporting on Stale Accounts

A security audit requires a list of all IdP accounts with no login activity in the past 90 days. The inactivity threshold can be set to 90 days, and the CSV report provides the structured evidence needed for the audit - automatically generated and attached to a trackable ticket.

Integrations

Integration	Role in the agent flow
Identity Provider (IdP)	Source of last-login timestamps and employee account status; queried to identify inactive accounts
Asset Management API (internal)	Cross-referenced with inactive employees to find company-owned devices assigned to dormant accounts
Service Desk (internal)	Tickets created and linked to affected assets; tracked by IT for remediation
Notifications system (Slack/Teams)	Notifies ticket assignee or desk managers when new findings are reported

FAQ

Two distinct workflows that share the same IdP inactivity query as their first step. The first (daily) focuses on employee account hygiene; the second (weekly) focuses on the asset risk those inactive accounts represent.

Works alongside

More agents for the same team