Lifecycle & Access Governance
Disable Account
Turn off a person's accounts on the systems you pick, now or on a date, with a reason and a justification on the record.
Completes when the selected accounts are disabled: after approval at the scheduled time, or at once when a workflow admin skips workflow.
https://mcp.avatier.com/mcp
Ask in Plain Language
Run Disable Account from the AI Assistant You Already Use
The approval workflow set up for each system decides who approves, with identity verification first in Avabot and MCP, where every disable is filed as an approval request. One completed account disable = one Secure Outcome; failed attempts are never billed.
You: Disable Chris Vance's accounts. Reason: Termination. Justification: last day was Friday. Avatier: verify: passed · reason: Termination · systems: picked from list · request: submitted for approval
Why it matters
Access Should End When the Job Does.
A departing or absent person's accounts stay live until someone turns them off, on every system they reach.
What a disable needs
The person's accounts on the systems to turn off, a reason (Termination, Leave of Absence or Layoff), a time, and a justification, routed through each system's approval workflow.
What goes wrong by hand
Disabling accounts by hand, one system at a time, makes it easy to miss one, and leaves no request or approval record behind.
Why it matters now
A single, outdated user account can be all it takes for a catastrophic breach.
What per-seat pricing charges
Per-seat IAM charges for every licensed seat, whether any account is disabled this month or not. Pay Per Identity Action™ charges only for completed account disables.
The Action
How Disable Account Runs
On the web, Disable Account walks through these screens. In Avabot and MCP you verify, name the person, pick systems, give a reason and a justification, and confirm.
Verify in Avabot or MCP
Avabot and MCP only. Disable Account starts with identity verification in the conversation, with the methods your policy already allows. On the web there is no extra check beyond your sign-in. Disable Account is high-risk, so by default it starts only if you verified in the last 5 minutes; otherwise you verify again.
Identity Verification (Avabot and MCP)
Select the User
Pick the system and search for the person: someone you are authorized to request for. You can't disable your own account. Workflow admins are then asked "Would you like to use workflow?"
Set the Reason and Time
Pick a reason: Termination, Leave of Absence or Layoff. Choose Disable Now or a date and time, and enter a Justification. A workflow admin who skips workflow picks only the reason and the systems.
Pick the Systems
Pick the systems to disable. Systems marked "never disable" on their connector are not offered.
Continue
Choose Continue to submit. The request is recorded in Request History with a Request ID and goes through the Lifecycle Management approval workflow for each selected system. A workflow admin with Account Terminator rights who skips workflow disables the account at once, with no request, and sees a result for each system.
Approval point
Available on Web, Mobile, Teams, Avabot chat and MCP.
Avabot chat and MCP require the current (.NET 10) Avatier server.
In Avabot chat and MCP, Disable Account always files an approval request that runs as soon as it is approved: there is no scheduling and no way to skip approval. Chat also offers Orphan as a reason.
Secure Outcome
What Counts as Done
A Secure Outcome is a completed, verified, policy-compliant identity action. An account disable completes when the person's selected accounts are disabled, after approval at the scheduled time. On Active Directory, connector settings can add clean-up steps, such as moving the account to a set OU, removing group memberships or hiding the Exchange mailbox. A workflow admin who skips workflow disables the accounts at once, with no request and a result for each system. One completed account disable = one Secure Outcome.
Evidence
- A Request ID in Request History (filter Disable Account, PDF or Excel export)
- An activity-log entry
- Audit reports such as Lifecycle Management requests submitted and approved, and Account Terminator accounts disabled
- A result for each system, when a workflow admin skips workflow
Guardrails
Your Assistant Asks. Avatier Decides.
Verified First
Avatier verifies the person before sensitive changes, with the methods your policy already allows.
Acts as the Signed-In User
OAuth sign-in to your own tenant. No shared service account, no API key to manage.
Never Makes Up Values
The connector only sends what the person actually said, and asks when something is missing.
Every Request Recorded
Requests land in Request History, ready to review and export.
Pay Per Identity Action™
Pay per Completed Account Disable
Pay per completed account disable. Failed attempts are never billed.
| Compared | Manual or Per-Seat IAM | Disable Account, Pay Per Identity Action™ |
|---|---|---|
| What you pay for | Every licensed seat, whether it acts or not | Completed account disables only |
| Failed attempts | No line between an attempt and a result | Attempts, failures and retries are never billed |
| The work | Manual intervention or tickets | Once approved, the selected accounts are disabled at the scheduled time, with any clean-up steps your connectors set |
| Evidence | Silent failures and missing audit trails | A Request ID in Request History, an activity-log entry and audit reports |
Pay Per Identity Action™ is in invitation-only preview. Pricing is shared with qualified organizations.
Works with the Systems Disable Account Touches
Disable Account turns off the person's accounts in the connected systems you select, such as Active Directory, Entra ID, LDAP, Okta and other connector-managed applications. Systems marked "never disable" on their connector are not offered and are skipped.
- LDAP
- Okta
- Microsoft
- Active Directory and Entra ID accounts, through their connectors. On Active Directory, connector settings can add clean-up steps such as moving the account to a set OU, removing group memberships or hiding the Exchange mailbox.
- Other Systems
- LDAP, Okta and other connector-managed applications, through their connectors.
Avatier MCP
New to Avatier MCP?
The Model Context Protocol is an open standard, stewarded by the Linux Foundation, that lets AI assistants call real systems through connectors instead of custom integrations.
Up and Running in Under a Minute
One URL works in every MCP client. Pick yours, copy, paste, sign in.
Microsoft Copilot Studio
Claude Code
OpenAI Codex
Cursor
Frequently Asked Questions
Can I schedule a disable for someone's last day?
Yes. In the web app, choose a date and time instead of Disable Now. Avabot always submits a request that runs as soon as it is approved.
What reasons can I pick?
Termination, Leave of Absence or Layoff on the web; Avabot also offers Orphan. The reason is recorded with the request, and connector settings decide any clean-up steps.
Can we stop certain systems from ever being disabled?
Yes. Systems flagged "never disable" on their connector are not offered and are skipped.
Does Leave of Absence turn the account back on later?
No. Choosing Leave of Absence does not schedule an automatic re-enable. Use Enable Account when the person returns.
Does Avatier provide AI-driven compliance reporting?
Yes. Avatier turns continuous identity and access data into audit-ready reports on demand, using AI to assemble who has access to what, what changed, and who approved it, mapped to the controls auditors expect. Instead of a manual evidence scramble before each audit, you generate plain-language, exportable reports covering SOC 2 Type II and ISO 27001, plus the evidence needs associated with NIST, SOX, HIPAA, and GDPR.
What is AI-driven configuration?
Avatier's AI-driven config turns plain-language intent into working policy. Rather than hand-coding rules, connectors, and roles, administrators describe what they need and Avatier recommends and sets up provisioning rules, role mappings, and workflows, then validates them before they go live. It shortens deployment from months to days and keeps configuration consistent, auditable, and free of custom scripting.
What is Pay Per Identity Action™?
Pay Per Identity Action™ is Avatier's pricing mechanic. Customers pay only for completed, verified, policy-compliant identity actions, called Secure Outcomes.
Is it the same as pay-per-action advertising?
No. Pay per action (PPA) is performance-marketing vocabulary for paying when an ad converts. Pay Per Identity Action™ charges for completed identity work.
How do I get started?
Getting started is free, deployment services are included, and a 45-day money-back guarantee applies. Contact Avatier for pricing for your organization.
What is MCP?
The Model Context Protocol is an open standard, stewarded by the Linux Foundation, that lets AI assistants call real systems through connectors instead of custom integrations.
How is it billed?
Pay Per Identity Action™ is in invitation-only preview: each completed, verified action is one Secure Outcome, and attempts, failures and retries are never billed.
Disable Account
You've Automated the System. Now Secure the Lifecycle.
Pick the systems, give a reason, and each disable request is recorded in Request History with a Request ID.