Revoke Bitwarden access when someone leaves in BambooHR
Every weekday morning we compare your password vault against your HR records and suspend access for anyone who has already left.
Integrations
Bitwarden
BambooHR
Slack Bot
Type
Categories
- Operations
- HR & People
Every weekday at 7am, reconcile my Bitwarden organization against our BambooHR employee directory so that people who have left the company never keep access to the shared vault.
Start by pulling the full employee directory from BambooHR with Get Employee Directory, and the complete member roster for my Bitwarden organization with List Members. Match the two lists on work email address. What I am looking for is every Bitwarden member who is currently active but is no longer an active employee in BambooHR, either because they have been terminated or because they no longer appear in the directory at all.
For each departure you are confident about, call Revoke Member Access. Do not call Remove Member. Revoking suspends the person's access while keeping the membership restorable, so if a match turns out to be wrong we can put them back with their previous role and collection assignments intact. Remove Member frees the seat irreversibly, which is not something I want happening unattended. Do not try to achieve this with a member update call either, because Bitwarden treats update bodies as full replacements and would reset any field you did not resend.
Leave anything ambiguous untouched instead of guessing. Contractors and vendors often hold vault access but never appear in BambooHR at all. Shared service accounts such as it-admin@ or billing@ do not belong to any single person. Some people sign in to Bitwarden with a personal address or an email alias that does not match their BambooHR work email. None of those should be revoked. Collect them for a human to decide on.
Finish by sending exactly one Slack message to our IT security channel with Send a Message. List everyone whose access was revoked, with their email and the reason, then separately list everyone who needs a human decision, with a one line note on why each one was unclear. If there was nothing to revoke and nothing ambiguous, still post the message saying the reconciliation ran clean. I want to see that it ran rather than be met with silence.
What it does
- Checks your Bitwarden member list against your BambooHR employee directory every weekday at 7am, matching people on their work email address.
- Suspends vault access for anyone who is still an active Bitwarden member but is no longer an active employee, so departures never keep a way in.
- Suspends rather than deletes, so a seat can be restored with their old permissions if someone was flagged by mistake.
- Leaves contractors, shared accounts, and mismatched email addresses alone, and hands them to you as a short review list instead of guessing.
What you’ll need
- A Bitwarden Teams or Enterprise organization, plus an owner who can generate the organization API key
- A BambooHR account with permission to view the employee directory
- A Slack workspace and a channel where your IT or security team gets alerts
How to customize it
- Change the timing so it runs every weekday, once a week, or only on the first working day of the month.
- Point the summary at a different Slack channel, or send it as a direct message to whoever owns access reviews.
- Adjust what counts as ambiguous, for example always skipping a known list of shared service accounts or contractor addresses.
Use cases
- Data Sync
- Notifications & Alerts
