Leaver automation
When someone leaves, their AWS access is easy to forget: an old access key or console password can outlive them by years. Leaver automation makes their leaver report the day they leave, without anyone having to remember.
Connecting
Microsoft 365: a Microsoft Entra admin grants consent for the organisation; Strays can then read which users are disabled or deleted (read-only, User.Read.All).
An admin connects it in Settings, under Leaver automation, and only admins can disconnect it. The first check only notes who had already left, so you don't get reports for people who left years ago.
Every day
Strays looks for people who were suspended, disabled or deleted since the day before. For each one it makes a leaver report across your connected AWS accounts and emails your admins a link. Reports from the directory show "(automatic)" on the People page.
The report finds their IAM user by their email, or the part before the @ (so
alex@example.com finds the IAM user alex). Single sign-on access is
removed by suspending them in the directory itself.
Strays only reads the directory; it never changes anyone there or in AWS. Disconnect any time in Settings, and remove Strays in the Microsoft Entra admin centre too.
Leaver automation is on the Team plan and above, and during the trial.