Lifecycle & Access Governance
Change Account Expiration
Set when a person's accounts expire, or make them never expire, with a justification on the record.
Completes when the new expiration date is set on the selected systems, once the request is approved.
https://mcp.avatier.com/mcp
Ask in Plain Language
Run Change Account Expiration from the AI Assistant You Already Use
Your Lifecycle Management approval workflow decides who approves, with identity verification first in Avabot and MCP. One completed expiration change = one Secure Outcome; failed attempts are never billed.
You: Set Riley Chen's account to expire on 31 March. Justification: contract extended. Avatier: verify: passed · account: main account · expires: 31 March · request: submitted, number returned
Why it matters
Every Account Should End When the Need Does.
Temporary access needs an end date that matches the work, and a change to that date needs a reason.
What a change needs
The person's accounts, the systems to change, a new date or Never expire, and a justification, routed through your approval workflow.
What goes wrong by hand
Changing end dates by hand, system by system, leaves no request, no approval and no record of who changed the date or why.
What Change Account Expiration does
On the web you pick the systems and the new date, up to five years ahead, or Never expire. Workflow admins can also upload a CSV batch.
What per-seat pricing charges
Per-seat IAM charges for every licensed seat, whether any expiration date changes this month or not. Pay Per Identity Action™ charges only for completed expiration changes.
The Action
How Change Account Expiration Runs
On the web, Change Account Expiration walks through these screens, with a Batch tab for workflow admins. In Avabot and MCP you verify, name the person, give a new date or say it never expires, and give a justification.
Verify in Avabot or MCP
Avabot and MCP only. Change Account Expiration starts with identity verification in the conversation, with the methods your policy already allows. On the web there is no extra check beyond your sign-in. By default, it does not need a fresh verification.
Identity Verification (Avabot and MCP)
Select the User
Pick the system and search for the person: someone you're authorized to request for. Workflow admins are then asked "Would you like to use workflow?"
Give a Justification
Enter a Justification. A workflow admin who skips workflow goes straight to the system list.
Pick the Systems
Pick which of the person's systems to change.
Set the Date
Choose Expire now, Days/hours to expire, a date and time up to five years ahead, or Never expire.
Submit
On the workflow path, submit. The change is recorded in Request History with a Request ID and goes through your Lifecycle Management approval workflow; the new date is set once it is approved.
Approval point
Or Run a Batch
Workflow admins only. On the Batch tab, upload a CSV of domain, user ID and expiration date (the first row is a header), review the list and run it. Batch changes apply immediately with no approval, change each user's main account only, always set a date, and show a result for each user.
Available on Web, Mobile, Teams, Avabot chat and MCP.
Avabot chat and MCP require the current (.NET 10) Avatier server.
In Avabot chat and MCP, Change Account Expiration changes one person's main account only: there is no system choice and no batch.
Secure Outcome
What Counts as Done
A Secure Outcome is a completed, verified, policy-compliant identity action. An expiration change completes when the new date is set, once the request is approved, on systems that support an account end date. Systems without one report a failure. A batch run applies each change at once, with no approval, and shows a result for each user. One completed expiration change = one Secure Outcome.
Evidence
- A Request ID in Request History (filter Change Account Expiration, exportable)
- An activity-log entry
- The request number, quoted in Avabot
- A result for each user, for a batch run
Guardrails
Your Assistant Asks. Avatier Decides.
Verified First
Avatier verifies the person before sensitive changes, with the methods your policy already allows.
Acts as the Signed-In User
OAuth sign-in to your own tenant. No shared service account, no API key to manage.
Never Makes Up Values
The connector only sends what the person actually said, and asks when something is missing.
Every Request Recorded
Requests land in Request History, ready to review and export.
Pay Per Identity Action™
Pay per Completed Expiration Change
Pay per completed expiration change. Failed attempts are never billed.
| Compared | Manual or Per-Seat IAM | Change Account Expiration, Pay Per Identity Action™ |
|---|---|---|
| What you pay for | Every licensed seat, whether it acts or not | Completed expiration changes only |
| Failed attempts | No line between an attempt and a result | Attempts, failures and retries are never billed |
| The work | Manual intervention or tickets | Once approved, the new end date is set on each selected system that supports one |
| Evidence | Silent failures and missing audit trails | A Request ID in Request History and an activity-log entry |
Pay Per Identity Action™ is in invitation-only preview. Pricing is shared with qualified organizations.
Works with the Systems Change Account Expiration Touches
Change Account Expiration sets the end date on systems that support one: Active Directory, directly or through the on-premises agent, and SAP. Entra ID, Okta and other connectors without an end date report a failure.
- SAP
- Microsoft
- Active Directory account end dates, directly or through the on-premises agent. Entra ID has no account end date here, so a change there reports a failure.
- Other Systems
- SAP account end dates. Okta and other connectors without an end date report a failure.
Avatier MCP
New to Avatier MCP?
The Model Context Protocol is an open standard, stewarded by the Linux Foundation, that lets AI assistants call real systems through connectors instead of custom integrations.
Up and Running in Under a Minute
One URL works in every MCP client. Pick yours, copy, paste, sign in.
Microsoft Copilot Studio
Claude Code
OpenAI Codex
Cursor
Frequently Asked Questions
Can I make an account never expire?
Yes. Choose Never expire on the web, or tell Avabot it never expires. The batch upload always sets a date.
Can I change expiration for many users at once?
Yes. Workflow admins can use the Batch tab and upload a CSV with domain, user ID and the new expiration date. The changes apply immediately.
Why did the change fail on our cloud directory?
Account end dates are supported on Active Directory, directly or through the on-premises agent, and SAP. Connectors without an end date, such as Entra ID or Okta, report a failure.
Does Avatier provide AI-driven compliance reporting?
Yes. Avatier turns continuous identity and access data into audit-ready reports on demand, using AI to assemble who has access to what, what changed, and who approved it, mapped to the controls auditors expect. Instead of a manual evidence scramble before each audit, you generate plain-language, exportable reports covering SOC 2 Type II and ISO 27001, plus the evidence needs associated with NIST, SOX, HIPAA, and GDPR.
What is AI-driven configuration?
Avatier's AI-driven config turns plain-language intent into working policy. Rather than hand-coding rules, connectors, and roles, administrators describe what they need and Avatier recommends and sets up provisioning rules, role mappings, and workflows, then validates them before they go live. It shortens deployment from months to days and keeps configuration consistent, auditable, and free of custom scripting.
What is Pay Per Identity Action™?
Pay Per Identity Action™ is Avatier's pricing mechanic. Customers pay only for completed, verified, policy-compliant identity actions, called Secure Outcomes.
Is it the same as pay-per-action advertising?
No. Pay per action (PPA) is performance-marketing vocabulary for paying when an ad converts. Pay Per Identity Action™ charges for completed identity work.
How do I get started?
Getting started is free, deployment services are included, and a 45-day money-back guarantee applies. Contact Avatier for pricing for your organization.
What is MCP?
The Model Context Protocol is an open standard, stewarded by the Linux Foundation, that lets AI assistants call real systems through connectors instead of custom integrations.
How is it billed?
Pay Per Identity Action™ is in invitation-only preview: each completed, verified action is one Secure Outcome, and attempts, failures and retries are never billed.
Change Account Expiration
You've Automated the System. Now Secure the Lifecycle.
Set the new end date, give a reason, and the change is recorded in Request History with a Request ID.