Inactive Employees
Detects inactive employee accounts and drives remediation through automated suspension and manager notification
- Runs periodic checks on employee login activity across identity systems
- Flags accounts that have been inactive beyond the configured threshold
- Distinguishes newly inactive accounts from those already being tracked
- Notifies managers about their inactive direct reports
- Opens a ticket for review and potential suspension
- Auto-resolves once account activity resumes
What Inactive Employees does
Inactive Employees is Harmony's dual-workflow monitoring system for detecting and surfacing employees who have gone dormant in the identity provider, and the company-owned assets still assigned to them. Two complementary scheduled workflows run on configurable cadences: one finds employees whose last IdP login exceeds a threshold and creates a CSV-backed IT ticket, and a second cross-references those inactive accounts with asset management to surface devices that may be sitting idle or at risk of being lost. IT teams start each week knowing exactly who has drifted out of activity and what hardware is tied to those accounts.
Who Inactive Employees Is For
IT operations teams responsible for identity hygiene, account governance, and asset lifecycle management.
Inactive accounts represent a security risk (stale credentials) and a compliance concern (unused licenses). Assets assigned to inactive employees may be unreturned, untracked, or at risk. Without automated monitoring, IT has no proactive way to detect either problem until something goes wrong - these workflows surface both automatically.
Workflow 1: Inactive Employees in IdP (Daily)
A cron schedule fires (default: daily at 8 AM UTC).
- Query inactive employees
The workflow queries the IdP for all employees whose last login exceeds the configured inactivity threshold (default: 30 days). Employees who have never logged in are also included. Optionally includes service accounts.
- Frequency filter
Employees already reported within the re-reporting window (default: 7 days) are filtered out to avoid duplicate tickets on the same accounts.
- CSV report
All newly flagged inactive employees are serialized into a CSV report.
- Ticket creation
A ticket titled "Inactive Employees Detected in IdP" is created in the IT desk with the CSV attached.
The ticket assignee (or desk managers if unassigned) is notified via Slack or Teams.
Workflow 2: Assets Assigned to Inactive Employees (Weekly)
A cron schedule fires (default: weekly, Monday at 8 AM UTC).
- Query inactive employees
Same IdP inactivity query as Workflow 1.
- Cross-reference with assets
For each inactive employee, the workflow fetches their company-owned assets from asset management.
- Frequency filter
Assets already reported within the re-reporting window are filtered out.
- CSV report + ticket
A ticket titled "Assets Related to Inactive Employees" is created with the CSV attached and the related asset IDs linked, so IT can take direct action on each device.
Assignee or desk managers are notified.
Capabilities
- IdP inactivity detection - Identifies employees whose last login to the identity provider exceeds a configurable threshold (default: 30 days), including accounts that have never logged in.
- Service account inclusion - Configurable option to include or exclude service accounts from the inactivity query.
- Asset cross-referencing - For each inactive employee, fetches all company-owned assets assigned to them so IT can see what hardware is tied to dormant accounts.
- Frequency-gated re-reporting - Tracks when each employee or asset was last reported and suppresses re-reports within the configured window (default: 7 days), preventing ticket spam on the same accounts.
- CSV export - Generates structured CSV reports for both inactive employees and their associated assets, attached to tickets for bulk review and action.
- Asset-linked tickets - The assets ticket includes related asset IDs so IT can navigate directly to affected devices in the asset management system.
- Configurable schedule - Each workflow's cron schedule and timezone are independently configurable per tenant.
- Smart notification routing - Notifies the configured ticket assignee; falls back to desk managers if no assignee is configured, avoiding silent ticket creation.
Main use cases
Weekly Identity Hygiene Audit - IT wants to ensure no employee accounts remain active in Okta after more than 30 days without a login - a common compliance requirement. The daily workflow queries the IdP, filters accounts that have already been reported this week, creates a ticket with the full CSV, and notifies the IT desk - automatically, every day. IT works through the list and takes action on each account.
Recovering Assets From Inactive Employees - IT suspects that several laptops are assigned to employees who haven't logged in for months. They need to identify and recover those devices. The weekly assets workflow cross-references inactive employees with asset management, finds all company-owned devices tied to those accounts, and creates a ticket with the asset list and a CSV. IT sees exactly which assets need to be recovered and from whom.
Compliance Reporting on Stale Accounts - A security audit requires a list of all IdP accounts with no login activity in the past 90 days. The inactivity threshold can be set to 90 days, and the CSV report provides the structured evidence needed for the audit - automatically generated and attached to a trackable ticket.
Integrations
| Integration | Role in the agent flow |
|---|---|
| Identity Provider (IdP) | Source of last-login timestamps and employee account status; queried to identify inactive accounts |
| Asset Management API (internal) | Cross-referenced with inactive employees to find company-owned devices assigned to dormant accounts |
| Service Desk (internal) | Tickets created and linked to affected assets; tracked by IT for remediation |
| Notifications system (Slack/Teams) | Notifies ticket assignee or desk managers when new findings are reported |
FAQ
Two distinct workflows that share the same IdP inactivity query as their first step. The first (daily) focuses on employee account hygiene; the second (weekly) focuses on the asset risk those inactive accounts represent.
Meet more Agents
