Offboard by Disabling Entra User and Removing from Group

arazzo: 1.0.1
info:
  title: Offboard by Disabling Entra User and Removing from Group
  summary: Disable a Microsoft Entra user, remove group membership, and revoke Slack access.
  description: >-
    An offboarding workflow that disables a departing employee's Microsoft Entra
    ID account, removes them from a privileged security group, and removes the
    user from the Slack workspace. Demonstrates a coordinated deprovisioning
    sequence across an identity provider and a collaboration platform.
  version: 1.0.0
sourceDescriptions:
  - name: entraApi
    url: https://raw.githubusercontent.com/api-evangelist/microsoft-entra/refs/heads/main/openapi/_original/microsoft-entra-graph-identity-openapi.yml
    type: openapi
  - name: slackAdminApi
    url: https://raw.githubusercontent.com/api-evangelist/slack/refs/heads/main/openapi/slack-administrative-api-openapi.yml
    type: openapi
workflows:
  - workflowId: offboard-disable-and-remove
    summary: Disable Entra user, remove from group, and remove from Slack.
    description: >-
      Disables a departing user's Entra account, removes them from a target
      security group, and removes the user from the Slack workspace.
    inputs:
      type: object
      properties:
        userId:
          type: string
        groupId:
          type: string
        slackTeamId:
          type: string
        slackUserId:
          type: string
    steps:
      - stepId: disable-user
        description: Disable the departing user's Entra account.
        operationId: $sourceDescriptions.entraApi.updateUser
        parameters:
          - name: user-id
            in: path
            value: $inputs.userId
        requestBody:
          contentType: application/json
          payload:
            accountEnabled: false
        successCriteria:
          - condition: $statusCode == 204
        outputs:
          disableStatus: $statusCode
      - stepId: remove-from-group
        description: Remove the user from the target security group.
        operationId: $sourceDescriptions.entraApi.removeGroupMember
        parameters:
          - name: group-id
            in: path
            value: $inputs.groupId
          - name: directory-object-id
            in: path
            value: $inputs.userId
        successCriteria:
          - condition: $statusCode == 204
        outputs:
          removeStatus: $statusCode
      - stepId: remove-from-slack
        description: Remove the departing user from the Slack workspace.
        operationId: $sourceDescriptions.slackAdminApi.postAdminUsersRemove
        requestBody:
          contentType: application/x-www-form-urlencoded
          payload:
            team_id: $inputs.slackTeamId
            user_id: $inputs.slackUserId
        successCriteria:
          - condition: $statusCode == 200
        outputs:
          slackOk: $response.body#/ok
    outputs:
      disableStatus: $steps.disable-user.outputs.disableStatus
      removeStatus: $steps.remove-from-group.outputs.removeStatus
      slackOk: $steps.remove-from-slack.outputs.slackOk