Integrations

PurpletGo connects to your SaaS tools so you can revoke access to all systems from a single click - the Nuke button on the IT Revocation stage.

Available integrations

Identity & access

Google Workspace

PurpletGo suspends the account, signs it out of every session, revokes the tokens of third-party apps the person authorised, and removes the account from every Google group. It then reads the account back: it must show as suspended, with no app tokens and no group memberships left. Anything else makes the result Failed with NOT CONFIRMED and what is left, for example 2 groups left: eng@acme.com, all@acme.com. If the token or group step itself fails, the result is Failed with PARTIAL, naming the step; the account is still suspended and signed out. About a day after a confirmed revocation, the account is read again: if it is active again or back in a group, the result becomes Failed and Admins are told.

On an offboarding under legal hold, the account is still suspended, signed out and its tokens revoked, but its group memberships are kept (a license or shared access granted through a group goes with the membership). The result still counts as revoked, and the later check doesn't look at groups.

Transfer Drive files to the manager is off by default. A Super Admin can turn it on in Integrations > Google Workspace > Settings. When it is on, and the person's access has been removed and confirmed, Google transfers their Drive files, shared and private, to the manager's email on the offboarding.

• The offboarding needs a manager's email (set in the wizard or by editing the offboarding), and the manager must be a user in the same Google Workspace. Without a manager's email, nothing is transferred and the Google Workspace result says so.
• A Google Workspace connection made before Drive transfer was available must be reconnected once to grant the Drive transfer permission (admin.datatransfer). While the setting is on and the permission is missing, the Google Workspace card shows a warning.
• On an offboarding under legal hold, nothing is transferred. The transfer waits and starts once the hold has ended (a released hold keeps protecting the record for 7 days).
• The offboarding's page shows Drive files: transferring, transferred, failed with the reason, or waiting for the legal hold to end. PurpletGo checks Google's progress every hour.
• A failed transfer doesn't change the revocation result: access is already removed. Admins are notified, and it is not retried: finish it in the Google Admin console (Data transfer).
• If the setting is turned off while a transfer waits for a hold, it doesn't start and shows as failed, without a notification.

Changes to the setting, and each transfer's start, completion or failure, are recorded in the audit log.

Microsoft 365

PurpletGo disables the account, revokes its sign-in sessions, removes its group memberships and licenses, and sets an out-of-office auto-reply on the mailbox:

• Inside your organisation: "[Name] is no longer with the company. Please contact [manager's email]." When the offboarding has no manager's email, it says "Please contact your manager."
• Outside: "[Name] is no longer with the company. Please contact us via our main support channel."

The auto-reply is on by default. A Super Admin can turn it off in Integrations > Microsoft 365 / Azure AD > Settings; the change is recorded in the audit log. The auto-reply never fails the result. It needs the MailboxSettings.ReadWrite permission: without it, the result says it was skipped.

On an offboarding under legal hold, the account is still disabled and signed out, but group memberships and licenses are kept, so Microsoft doesn't start deleting the mailbox and OneDrive. The result still counts as revoked.

Development tools

Design & productivity

Communication

Cloud infrastructure

AWS IAM policy

Give the IAM user or role PurpletGo uses this policy. Each statement is one part of the revocation: without a permission, that part is reported as By hand, naming what to remove, and is never counted as revoked.

{
  "Version": "2012-10-17",
  "Statement": [
    {
      "Sid": "PurpletGoConnectionTest",
      "Effect": "Allow",
      "Action": ["iam:GetAccountSummary"],
      "Resource": "*"
    },
    {
      "Sid": "PurpletGoRevokeIamUsers",
      "Effect": "Allow",
      "Action": [
        "iam:ListUserTags",
        "iam:ListAccessKeys",
        "iam:DeleteAccessKey",
        "iam:PutUserPolicy",
        "iam:GetUserPolicy",
        "iam:GetLoginProfile",
        "iam:DeleteLoginProfile",
        "iam:ListSSHPublicKeys",
        "iam:DeleteSSHPublicKey",
        "iam:ListSigningCertificates",
        "iam:DeleteSigningCertificate",
        "iam:ListServiceSpecificCredentials",
        "iam:DeleteServiceSpecificCredential"
      ],
      "Resource": "arn:aws:iam::*:user/*"
    },
    {
      "Sid": "PurpletGoLegalHoldDeactivate",
      "Effect": "Allow",
      "Action": [
        "iam:UpdateAccessKey",
        "iam:UpdateSSHPublicKey",
        "iam:UpdateSigningCertificate",
        "iam:UpdateServiceSpecificCredential"
      ],
      "Resource": "arn:aws:iam::*:user/*"
    },
    {
      "Sid": "PurpletGoIdentityCenter",
      "Effect": "Allow",
      "Action": [
        "sso:ListInstances",
        "sso:ListAccountAssignmentsForPrincipal",
        "sso:DeleteAccountAssignment",
        "sso:DescribeAccountAssignmentDeletionStatus",
        "sso:ListApplicationAssignmentsForPrincipal",
        "sso:DeleteApplicationAssignment",
        "identitystore:GetUserId",
        "identitystore:DescribeUser",
        "identitystore:ListGroupMembershipsForMember",
        "identitystore:DeleteGroupMembership"
      ],
      "Resource": "*"
    }
  ]
}

• PurpletGoLegalHoldDeactivate: for people whose offboarding is under legal hold, PurpletGo deactivates their credentials and keeps them as evidence instead of deleting them. Without these four permissions, that credential type is By hand on a held case.
• PurpletGoIdentityCenter: only if you use IAM Identity Center. Leave it out otherwise, and confirm in Integrations > AWS > Settings that you don't use it. PurpletGo removes the person's group memberships, account assignments and application assignments, never the user, and reads all three back. Without the two application-assignment permissions, the rest is still removed and the result is By hand, naming what wasn't covered. On an offboarding under legal hold, application assignments are kept (leaving an application can make it delete what the person holds there) and the result is By hand until Legal releases the hold. Integrations > AWS > Settings checks the two application-assignment permissions when you save Identity Center, and again with Check permissions, and shows a banner for any that is missing. To test the delete permission it asks AWS to remove an application assignment that cannot exist: nothing is removed, and your CloudTrail shows a failed DeleteApplicationAssignment call. Each check is in your audit log. A permission shows as missing only when AWS refuses it by name. Any other answer, for example one that points at another account or instance, shows as "could not check", with AWS's reason. The check needs the two application-assignment actions allowed on "Resource": "*", as in the policy above: a policy that allows them only on named applications can show them as missing although removals work. If yours is scoped that way, choose Our policy is scoped: skip this check in the same settings. The choice is recorded in your audit log; a permission that is really missing still makes AWS results By hand.
• If you run IAM Identity Center from another account than the one these credentials belong to (for example a delegated administrator account), enter that account's 12-digit ID as the Identity Center account ID in Integrations > AWS > Settings. The permission check asks about that account. Leave it empty otherwise.
• With cross-account AssumeRole, attach the policy to the role in your account, and allow PurpletGo's principal to assume it in the role's trust policy.

Business apps

Alumni engagement (rehire tracking)

Sync only ever fires for alumni who have explicitly opted into the alumni network - connecting a provider here only stores credentials, it never sends data by itself.

HRIS (data sync)

Scheduling (exit interviews)

Delivery (self-service portal)

Connecting an integration

1. Go to Integrations in the main navigation
2. Find the tool you want to connect - access-revocation tools (Jira Cloud, Figma, Asana, Linear, GitLab, Notion, Slack Admin, AWS, Zoom, Salesforce, HubSpot, Dropbox, Zendesk) are under the SaaS Access Revocation section
3. Click Connect and follow the OAuth or API key flow
4. Once connected, the integration will show a green Connected badge

Triggering access revocation

Revocation starts when someone clicks Nuke Access, or automatically when the person's last day ends (if Revoke access when the last day ends is on in Settings → General). Both run the same steps. Reaching the IT Revocation stage doesn't revoke anything by itself.

To revoke by hand:

1. Open the offboarding detail
2. Go to the IT Revocation section
3. Review the list of apps the employee has access to
4. Click Nuke Access, then Revoke all access. The revocation runs in the background: PurpletGo works through the apps one at a time, gives each vendor 30 seconds to answer, and shows each app's result as it finishes. You can close the dialog and the run carries on

Each revocation attempt is logged to the audit trail with status (success / failure) and timestamp. A failure shows the vendor's HTTP status and reason, for example Okta revocation failed (HTTP 403): Insufficient permissions; a timeout or connection failure says so. A run starts no new app after 8 minutes and stops at 10; apps it didn't reach show Not attempted and still have access. Try again re-runs the case: apps already revoked or confirmed as removed by hand are skipped, and the rest are tried again. At the end of the last day, each offboarding is revoked on its own, so one slow vendor doesn't delay the others, and a run that doesn't finish is retried. See Revoking access for the details.

HRIS sync

When an HRIS integration is connected, PurpletGo can:

• Pull employees - sync your roster from BambooHR / Workday / etc. directly into PurpletGo's directory
• Trigger offboardings - start an offboarding when an employee is marked as departed in your HRIS, after an admin approves it (or automatically, if you choose)

To connect one: go to Integrations, pick your HRIS provider's card, fill in its connection fields, and click Connect & Sync. There's no separate "enable auto-sync" toggle - nightly sync runs automatically for every connected HRIS integration.

How people are matched

Each person in the HR system is matched to your directory by their HR system employee ID first, when both sides have one, and by work email only when they don't. Someone whose email changed in the HR system keeps their directory record. If the HR system and a directory record share an email but carry different employee IDs, PurpletGo does not merge them: the record is left as it is, the sync reports a conflict, and the audit log records it. Fix the ID on one side and the next sync matches them.

Terminations: review first

When the HR system reports a termination, the HR system card has a setting for what happens:

• Wait for an admin to approve (the default): the termination appears on the HR system card, and the Integrations page shows a banner and a count, until a Super Admin or Admin approves it (the offboarding starts) or dismisses it. Nothing starts before that. Admins get an in-app notification and an email when terminations are waiting. A dismissed termination is not filed again unless the HR system reports a different date, or the person is reported active and then terminated again.
• Start the offboarding automatically: the sync starts the offboarding itself, as it did before this setting existed.

Every review, approval and dismissal is in the audit log, with who decided.

The per-sync limit

Most terminations per sync (10 unless you change it, from 1 to 1000) protects you from a mass termination or a broken export. If one sync would start more offboardings than that, it starts none of them and puts the whole batch on the HR system card for review, whatever the setting above. Admins are notified in-app and by email, and the sync history and audit log record that the batch was held.

When the HR system gives no termination date

PurpletGo never uses the sync date as the last working day. A termination without a date starts an offboarding with no exit date (on approval, or automatically), flagged Exit date missing on the case, and no access revocation is scheduled until someone sets the last working day by editing the offboarding. In review mode the review shows "No date" so the approver can see it first.

Plan limits

New people from the HR system are added only up to your plan's active-employee limit (100 on Starter, 500 on Team). The rest are listed in the sync result and the sync history, and admins get a notification with an upgrade link. People already in your directory keep syncing. See Plan limits.

Webhooks (outbound)

If your tool isn't listed, you can use Webhooks to build your own integration. PurpletGo can POST events to any HTTPS endpoint when key offboarding events occur.

Set endpoints up under Settings → Webhooks. Each endpoint shows when a delivery last arrived and how many failed in the last 24 hours. Open its delivery log (the arrow on the right) to see every event sent to it: Delivered, Retrying (with the time of the next attempt), Queued or Given up, with the HTTP status and error of the last attempt.

• Retries. A delivery that fails is tried again 1 minute, 5 minutes, 30 minutes, 2 hours, 8 hours and 24 hours later, 7 attempts in all. Deliveries are recorded before they are sent, so a restart on PurpletGo's side loses none.
• Redeliver. Once your endpoint is fixed, Redeliver sends a retrying or given-up delivery again, under the same delivery ID. Redeliveries are recorded in the audit log.
• Automatic pause. After 25 deliveries in a row are given up on, PurpletGo pauses the endpoint and tells Super Admins and Admins in the app and by email. Resume it with the play button once it's fixed; events from while it was paused are not sent.
• How long the log is kept. Delivered deliveries for 30 days, given-up ones for 90.

See Webhooks in the API reference for the full event list, payload schema, retry policy and the delivery log API.