Reference · built on requestOperator by FibricProperty & tenants

Access Offboarding

Matches lease ends and roster changes to the fobs, PINs, plates, and accounts each person holds, and proposes revocations for approval.

Request accessPricing ↗

About

Access Offboarding is an operator job for the credentials that outlive a lease. It reads move-out dates and leases on notice from Buildium or Entrata, the residents and staff on each roster, and the credentials each person holds: ButterflyMX access tools, keychains, and virtual keys; Brivo users with their credentials and groups; Verkada access users with cards, entry codes, and license plates; Microsoft Entra ID accounts for building staff. It also reads access events after an end date, so a credential still in use is visible.

On a move-out date or a roster change it proposes the revocations for that person, system by system, and the manager approves each. Nothing is removed until then. The receipt records every credential removed, when, by whose approval, and how to reissue it.

This is a reference listing. It documents what Fibric would read from Access Offboarding and what it could propose, based on the vendor's published interfaces. Fibric builds it under a managed deployment when you request it; selecting it here installs nothing.

Inputs

  • Lease ends: Buildium move outs and lease end dates; Entrata getLeases and getExpiringLeases by move-out date, and leases placed on notice
  • Residents and staff: Buildium tenants; Entrata getCustomers; ButterflyMX Tenants per Building and Unit; Microsoft Entra ID users with accountEnabled and group membership
  • Credentials per person: ButterflyMX Access Tools, Keychains, and Virtual Keys; Brivo users, credentials, and groups; Verkada cards, entry codes, and license plates
  • Use after an end date: ButterflyMX access logs by name and unit; Brivo access events by user; Verkada access events
  • Roster changes a commercial tenant sends, as you enter them in the configuration or your property system
  • Directory changes: Microsoft Entra ID user and group deltas and directory audit records

Proposed actions

  • Target capability: propose revoking a resident's credentials on the move-out date: a ButterflyMX access tool deleted, a Brivo user suspended, or a Verkada end date
  • Target capability: propose deleting the ButterflyMX Tenant and the keychains and virtual keys issued under it
  • Target capability: propose disabling a departing staff member's directory account through PATCH /users/{id} with accountEnabled false, and removal from access groups
  • Target capability: propose deactivating a license plate or entry code on a Verkada access user when a permit ends
  • Target capability: propose a review list of credentials used after a lease ended, with each event, before any revocation

Proposed actions are target capabilities. Every action runs propose-first and needs a validated deployment and the appropriate permissions.

What you can build

  • Revoke fobs on a Buildium move-out

    A Buildium move out reaches its date. The operator proposes suspending the resident's Brivo user and removing them from their groups, and the manager approves. Access events after the date are listed with the proposal.

    With Buildium, Brivo Access

  • Close a ButterflyMX tenant at lease end

    An Entrata lease reaches its move-out date. The operator proposes deleting the ButterflyMX Tenant, their PIN and RFID access tools, and any virtual keys they issued, as one approval with each item listed.

    With Entrata, ButterflyMX

  • End-date Verkada credentials from a roster change

    A commercial tenant removes a name from their roster. The operator finds the Verkada access user, proposes an end date and deactivating their license plate, and shows the last access event.

    With Entrata, Verkada

  • Disable a departing staff account

    A staff leaver is proposed in two parts: accountEnabled false on the Microsoft Entra ID user, and suspension of their Brivo user with group removal. Each part is approved on its own.

    With Microsoft Entra ID, Brivo Access

Requirements

  • A property connector with move-out dates: Buildium or Entrata
  • At least one access system: ButterflyMX, Brivo Access, or Verkada, with an account whose role covers the users and access points concerned
  • A mapping from resident or staff record to the person in each access system, kept in the configuration
  • Optional: Microsoft Entra ID for staff accounts, with an application permission that allows disabling a user
Authentication
Owns no credential. Leases, rosters, and access records are read, and revocations proposed, through the connectors you bind, each limited to the roles its own administrator granted.

Limits

  • Revocation is per credential in each system. A fob enrolled in a system not bound here stays active until a person removes it
  • No parking or locker connector is in the catalog. Permits are handled where they are a credential, such as a Verkada license plate
  • A move-out date can move. A proposal is dated to the record as it stands and is raised again if the date changes
  • A deleted ButterflyMX RFID tag cannot be edited back; reissue means a new tag. The proposal says so before approval

Access and pricing

Reference listing. Fibric builds the operator under a managed deployment when you request it. Your quote covers the build, capabilities, usage, and support.

Request Access Offboarding ↗

Questions and answers

What does the manager approve for each person?
One proposal per person, listing every credential found across the bound systems with its last use. The manager approves all, removes an item, or defers. Each system's change happens only after that approval.
What record is left after a revocation?
The lease or roster change that triggered it, each credential as found, any use after the end date, the approval with name and time, each revocation as the access system confirmed it, and the steps to reissue.
Does it ever revoke without approval?
No. It proposes and waits. A credential used after a lease ended is raised as a review item, not removed. Disabling a directory account follows the same rule.
Ask about Access Offboarding

Ask about the capabilities and requirements in this listing.

For project-specific requirements, contact Fibric.

This operator is developed, published, and supported by Fibric. Third-party names and logos identify the systems an integration connects to; they are the property of their respective owners, who are not affiliated with Fibric and do not sponsor or endorse this listing. Trademark policy