# Autonomous Deprovisioning for IT

*/Opportunities/Autonomous_Deprovisioning_for_IT*

## Opportunity Overview

**Wedge**: Begin by targeting high-turnover sales organizations where offboarding happens frequently and involves specialized tools rarely tied to single sign-on. Prove value by reclaiming unused software seats and closing security gaps within 24 hours of departure. Expand from sales departments to full-company offboarding, eventually capturing onboarding and hardware provisioning.
**Timing**: Agentic systems now interact with unstructured admin consoles via DOM parsing and browser control, bypassing the need for official APIs. Simultaneously, companies face tighter compliance audits and increased pressure to cut unused SaaS spend, forcing IT to automate offboarding.
**Why This I C P**: Mid-market IT managers at companies with 500 to 2,000 employees experience high enough turnover to feel the pain daily but lack the dedicated security engineering teams of large enterprises to build internal automation.
**Size Of Prize**: There are approximately 40,000 mid-market companies in the US with dedicated IT teams. Assuming an average annual spend of $15,000 on manual offboarding labor and wasted SaaS licenses per company, the addressable prize is roughly $600M annually.
**Gap Narrative**: When an employee leaves, IT manually revokes access across dozens of unlinked SaaS apps, identity providers, and local machines. Current IAM tools only handle SSO-connected apps, leaving shadow IT and specialized tools vulnerable to former employees. This gap leaves companies exposed to compliance breaches and paying for unused licenses.
**Defensibility**: The product builds deep workflow lock-in by becoming the system of record for employee lifecycle state, replacing manual IT ticketing for offboarding. Over time, the platform accumulates a proprietary map of undocumented admin panel structures across thousands of niche SaaS applications, creating a data moat that competitors relying solely on official APIs cannot match.
**Why This Thesis**: The Agent approach fits perfectly because IT requires the outcome of a fully offboarded user without managing another complex workflow builder. An autonomous agent acts as a digital IT technician, executing the offboarding checklist across both API-enabled and legacy web-based admin panels.

## Opportunity Linked Thesis

**Thesis**: [Agent](/Theses/Agent)

## Opportunity Linked I C P

**Icp**: [High-Growth Tech Company](/CompanyTypes/High-Growth_Tech_Company)

## Opportunity Market Sizing

_Illustrative — target and order-of-magnitude estimate figures, not an achieved track record (this Thing is concept-stage)._

**S A M**: ~$450M-600M representing ~15k-20k high-growth tech companies with acute SaaS sprawl
**S O M**: ~$15M-30M realistic 3-year capture
**T A M**: ~100k mid-market and enterprise companies globally × ~$30k/yr average platform fee ≈ ~$3B
**Growth Rate**: ~18-25%/yr, driven by rapid SaaS stack expansion and tightening zero-trust security audits for immediate access revocation
**Paid Comparable Spend**: ~$40k-80k/yr per 1,000 employees in unrecovered SaaS licenses and dedicated L1/L2 IT helpdesk labor for manual offboarding tickets

## Opportunity Incumbents

- [Okta Lifecycle Management](/Products/Okta_Lifecycle_Management) — Tool
- [BetterCloud SaaS Management](/Products/BetterCloud_SaaS_Management) — Tool
- [Microsoft Entra ID](/Products/Microsoft_Entra_ID) — Tool
- [SailPoint IdentityIQ](/Products/SailPoint_IdentityIQ) — Tool
- [Custom PowerShell Scripts](/Products/Custom_PowerShell_Scripts) — DIY
- [Manual Helpdesk Tickets](/Products/Manual_Helpdesk_Tickets) — Service
- [HR Offboarding Spreadsheets](/Products/HR_Offboarding_Spreadsheets) — Spreadsheet

## Opportunity Win Conditions

**Kill Thresholds**:
- Sales cycle exceeds 90 days for 1,000-employee accounts
- Average connected SaaS applications remains under 4 after 30 days
- Human-in-the-loop manual fallback exceeds 25% of offboarding events
- Fewer than $5,000 in annualized license value reclaimed per account in the first 60 days
**Leading Metrics**:
- Time to first successful API write-back
- Number of ungoverned SaaS applications connected per workspace
- Percentage of offboarding workflows completed without IT intervention
- Dollar value of SaaS licenses reclaimed per month
- Rollback rate for falsely deprovisioned accounts
**What Proves Right**: IT administrators connect their core identity provider and at least five unmanaged SaaS applications during initial setup. They route all offboarding triggers through the system, resulting in zero orphan accounts discovered during quarterly security audits. Customers commit to $30,000 annual contracts after a 14-day proof of value that demonstrates immediate license reclamation savings.
**What Proves Wrong**: IT teams refuse to grant the platform write access to their critical SaaS APIs due to security compliance concerns. Administrators fall back to manual verification because the system frequently misidentifies service accounts as departing users. Customers churn after determining their existing identity provider already covers the majority of their actual risk surface.

## Opportunity Build Profile

**Hardest Part**: Handling partial failures across disparate undocumented SaaS APIs without accidentally destroying critical corporate data or leaving lingering ghost access. Securing atomic execution across systems requires building a highly fault-tolerant state machine for integrations you do not control.
**Min Viable Scope**: Deliver a linear API-driven offboarding flow triggered by a single HRIS platform like Gusto for 5 core SaaS applications. Leave out physical device wiping, on-premise Active Directory support, and complex file-transfer workflows.
**Cold Start Problem**: The product lacks utility until it supports a critical mass of the target company's specific SaaS stack. Break this by targeting companies that use a rigid uniform stack like Google Workspace, Slack, and GitHub, ignoring the long tail of shadow IT.
**Time To First Value**: 1-2 days to authenticate core IdP and HRIS integrations and run the first dry-run offboarding simulation.
**Data Moat Available**: false
**Technical Difficulty**: Moderate

## Neighborhood

### Incumbent in

- [BetterCloud](/Products/BetterCloud) — incumbent in · Products
- [Microsoft Entra ID](/Software/Microsoft_Entra_ID) — incumbent in · Software
- [Okta Lifecycle Management](/Products/Okta_Lifecycle_Management) — incumbent in · Products
- [SailPoint IdentityIQ](/Products/SailPoint_IdentityIQ) — incumbent in · Products
- [Custom PowerShell Scripts](/Products/Custom_PowerShell_Scripts) — incumbent in · Products
- [HR Offboarding Spreadsheets](/Products/HR_Offboarding_Spreadsheets) — incumbent in · Products
- [Manual Helpdesk Tickets](/Products/Manual_Helpdesk_Tickets) — incumbent in · Products

### Applies thesis

- [High-Growth Tech Company](/CompanyTypes/High-Growth_Tech_Company) — applies thesis · CompanyTypes

### Embodies

- [Agent](/Theses/Agent) — embodies · Theses

### Similar Opportunities

- [Identity Lifecycle Automation](/Opportunities/Identity_Lifecycle_Automation) — similar · Opportunities
- [Zero-Touch De-Provisioning for HR](/Opportunities/Zero-Touch_De-Provisioning_for_HR) — similar · Opportunities
- [Onboarding Orchestration Agent](/Opportunities/Onboarding_Orchestration_Agent) — similar · Opportunities
- [Day-One Provisioning Agent](/Opportunities/Day-One_Provisioning_Agent) — similar · Opportunities
- [Autonomous Provisioning for Enterprise IT](/Opportunities/Autonomous_Provisioning_for_Enterprise_IT) — similar · Opportunities
- [Employee IT Provisioning](/Opportunities/Employee_IT_Provisioning) — similar · Opportunities
- [Managed Auth Operations](/Opportunities/Managed_Auth_Operations) — similar · Opportunities
- [Attrition Arbitrage](/Opportunities/Attrition_Arbitrage) — similar · Opportunities
- [Autonomous L1 Responder](/Opportunities/Autonomous_L1_Responder) — similar · Opportunities
- [Automated Onboarding Agency](/Opportunities/Automated_Onboarding_Agency) — similar · Opportunities
- [Shared Services Resolver](/Industries/Management_of_Companies_and_Enterprises/Opportunities/Shared_Services_Resolver) — similar · Opportunities
- [Algorithmic Access Auditing for VMOs](/Opportunities/Algorithmic_Access_Auditing_for_VMOs) — similar · Opportunities
- [Knowledge Capture Agent](/Opportunities/Knowledge_Capture_Agent) — similar · Opportunities
- [Vendor Negotiation Agent](/Opportunities/Vendor_Negotiation_Agent) — similar · Opportunities
- [Autonomous Task Runner](/Opportunities/Autonomous_Task_Runner) — similar · Opportunities
- [AI Churn Reversal For SaaS](/Opportunities/AI_Churn_Reversal_For_SaaS) — similar · Opportunities
- [Turnkey Account Expansion](/Opportunities/Turnkey_Account_Expansion) — similar · Opportunities
- [Autonomous Sourcing for IT](/Opportunities/Autonomous_Sourcing_for_IT) — similar · Opportunities
- [Velocity Desk](/Opportunities/Velocity_Desk) — similar · Opportunities
- [B2B Outreach Agent](/Opportunities/B2B_Outreach_Agent) — similar · Opportunities