Lifecycle & Access Governance
Remove Access
Remove access that no longer fits, with a justification and a record of every change.
Completes when the privileges you picked are gone.
https://mcp.avatier.com/mcp
Ask in Plain Language
Run Remove Access from the AI Assistant You Already Use
Same policy, approvals and Justification as the console. One completed access removal = one Secure Outcome; failed attempts are never billed.
You: Remove Alex Kim's access to the finance share, with justification: role change. Avatier: policy: applied · privilege: finance share · justification: role change · request: recorded
Why it matters
A Single, Outdated User Account Can Be All It Takes for a Catastrophic Breach.
In the 2023 MGM Resorts cyberattack, attackers did not need to crack complex passwords or find a zero-day vulnerability. They simply called the help desk.
How it happened
The attackers found a former MGM employee's information on LinkedIn. Using this, they socially engineered the IT help desk to reset the password for the employee's old, but still active, account. This account had just enough access to become a foothold, leading to a system-wide shutdown that crippled operations for 10 days and cost the company an estimated $100 million.
Root cause
Stale Account: A former employee's account remained active and provisioned.
HR-triggered offboarding
Instant Offboarding: the moment an employee is marked as terminated in the HR system, Avatier instantly disables all accounts and revokes access, eliminating stale accounts.
What per-seat pricing charges
Per-seat IAM charges for every licensed seat, whether any access is removed this month or not. Pay Per Identity Action™ charges only for completed removals.
The Action
How Remove Access Runs
Remove Access follows the same pattern as every lifecycle action: select the user, fill in the form, check the summary, submit.
Select the User
Pick the user whose access is being removed.
Pick the Privileges
Choose the privileges to remove.
Give the Reason
Add a justification. Related screens ask for a reason for acting: Termination, Leave of Absence or Layoff.
Check Ownership Impact
Related screens include an Ownership Impact review: Current Owners, After Removal, Minimum Required and At Risk.
Check the Summary
Review the user, privileges and justification on the summary screen.
Submit
Submit the request. It is recorded with a Request ID.
Available on Web, Avabot chat and MCP.
Secure Outcome
What Counts as Done
A Secure Outcome is a completed, verified, policy-compliant identity action. An access removal completes when the privileges you picked are gone. One completed access removal = one Secure Outcome.
Evidence
- A Request ID
- Request History with Export
- Activity and audit logs
Guardrails
Your Assistant Asks. Avatier Decides.
Verified First
Avatier verifies the person before sensitive changes, with the methods your policy already allows.
Same Policy as the Console
Approvals, justification and role rules apply exactly as they do on the web.
Acts as the Signed-In User
OAuth sign-in to your own tenant. No shared service account, no API key to manage.
Never Makes Up Values
The connector only sends what the person actually said, and asks when something is missing.
Every Request Recorded
Requests land in Request History, ready to review and export.
Pay Per Identity Action™
Pay per Completed Removal
Pay per completed removal. Failed attempts are never billed.
| Compared | Manual or Per-Seat IAM | Remove Access, Pay Per Identity Action™ |
|---|---|---|
| What you pay for | Every licensed seat, whether it acts or not | Completed removals only |
| Failed attempts | No line between an attempt and a result | Attempts, failures and retries are never billed |
| Stale access | A former employee's account remained active and provisioned | Access removed with a justification and a reason for acting |
| Evidence | Silent failures and missing audit trails | A Request ID on every request, and Request History with Export |
Pay Per Identity Action™ is in invitation-only preview. Pricing is shared with qualified organizations.
Works with the Systems Remove Access Touches
Remove Access works across Active Directory, Entra ID, Microsoft 365 and any cloud or business application, with audit, ticketing, logging, SIEM, email, and notifications through the workflow orchestration engine.
- Microsoft 365
- Microsoft
- Active Directory, Entra ID, and Microsoft 365 licensing.
- Cloud Apps and Legacy Systems
- Any cloud or business application.
- Audit and Operations
- Audit, ticketing, logging, SIEM, email, and notifications through the workflow orchestration engine.
Avatier MCP
New to Avatier MCP?
The Model Context Protocol is an open standard, stewarded by the Linux Foundation, that lets AI assistants call real systems through connectors instead of custom integrations.
Up and Running in Under a Minute
One URL works in every MCP client. Pick yours, copy, paste, sign in.
Claude
Claude Code
GitHub Copilot
Cursor
Gemini CLI
Frequently Asked Questions
Does Remove Access disable accounts automatically when HR marks a termination?
No. Remove Access is a manual flow: a manager or admin selects the user and the privileges, adds a justification and submits. Disabling accounts the moment HR marks a termination is Instant Offboarding, part of Avatier HR User Provisioning.
Is Avatier secure enough for large enterprises or regulated industries?
Absolutely. Avatier applies zero-trust controls, maintains fully auditable identity records, and holds SOC 2 Type II and ISO 27001 certifications. It also helps organizations support requirements and evidence needs associated with NIST, SOX, HIPAA, and GDPR. Every provisioning action is policy-enforced and auditable.
Does Avatier provide AI-driven compliance reporting?
Yes. Avatier turns continuous identity and access data into audit-ready reports on demand, using AI to assemble who has access to what, what changed, and who approved it, mapped to the controls auditors expect. Instead of a manual evidence scramble before each audit, you generate plain-language, exportable reports covering SOC 2 Type II and ISO 27001, plus the evidence needs associated with NIST, SOX, HIPAA, and GDPR.
What is AI-driven configuration?
Avatier's AI-driven config turns plain-language intent into working policy. Rather than hand-coding rules, connectors, and roles, administrators describe what they need and Avatier recommends and sets up provisioning rules, role mappings, and workflows, then validates them before they go live. It shortens deployment from months to days and keeps configuration consistent, auditable, and free of custom scripting.
What is Pay Per Identity Action™?
Pay Per Identity Action™ is Avatier's pricing mechanic. Customers pay only for completed, verified, policy-compliant identity actions, called Secure Outcomes.
Is it the same as pay-per-action advertising?
No. Pay per action (PPA) is performance-marketing vocabulary for paying when an ad converts. Pay Per Identity Action™ charges for completed identity work.
How do I get started?
Getting started is free, deployment services are included, and a 45-day money-back guarantee applies. Contact Avatier for pricing for your organization.
What is MCP?
The Model Context Protocol is an open standard, stewarded by the Linux Foundation, that lets AI assistants call real systems through connectors instead of custom integrations.
How is it billed?
Pay Per Identity Action™ is in invitation-only preview: each completed, verified action is one Secure Outcome, and attempts, failures and retries are never billed.
Remove Access
You've Automated the System. Now Secure the Lifecycle.
The MGM breach is a stark reminder that manual processes and disconnected systems create immense risk.