For Security Teams

You shouldn't have to take a tool's word for it

Most deprovisioning tools report success and move on. PurpletGo revokes access across the identity providers and apps you connect, then makes each one report back with a reason. Retrying re-runs only what failed, and the case will not close while anything is still unresolved.

Start free trial View integrations

30-day free trial - no credit card required

What you get

Built for IT and security teams

The differentiated parts first: a real result per system, and connectors that only go Live after a verified revoke.

A result for every system

A system is marked revoked only when the vendor confirms it. Anything PurpletGo cannot act on or verify is flagged for manual action with the reason, retrying only re-runs what failed, and the case waits until it is resolved.

Connectors verified against live accounts

Six are Live: Google Workspace, Microsoft 365 / Entra ID, Okta, Slack, GitHub and AWS. Each had a real revoke run against a live vendor account. Slack revocation uses Slack SCIM, so it needs a Slack Business+ or Enterprise plan. Everything else stays marked beta until it passes the same test.

Revocation in one action

Revoke the connected identity provider and the apps you select together, from the offboarding record. JumpCloud, OneLogin, and Ping (beta) on Enterprise.

Access discovery

Connected identity providers suggest which apps the person can reach before you revoke.

Tamper-evident audit log

Every entry is HMAC-signed and chained to the one before it, with on-demand chain verification.

Team and Enterprise

SAML 2.0 SSO & SCIM 2.0

Enforce SSO with JIT provisioning and group-to-role mapping, and deprovision through SCIM.

Team and Enterprise

Role-based access control

Five built-in roles with permissions enforced on every API endpoint, plus custom roles on Enterprise.

IT ticket sync

Create deprovisioning tickets in Jira, ServiceNow, Freshdesk, or Zendesk and sync their status back (in beta).

Team and Enterprise

SIEM export

Send offboarding events to Splunk, Datadog, or any SIEM that accepts a webhook.

Enterprise

In practice

How PurpletGo fits into your IT workflow

Revoke, then confirm

Select the systems for a departing employee and revoke them in one action. Each one comes back as revoked, failed, or needs manual action with the vendor's reason. A system counts as revoked only when the vendor confirms it, so a single API error never gets marked as done.

Start from what they can actually reach

PurpletGo reads app assignments from Okta, Google Workspace, and Entra ID to suggest what to revoke, and on Team a termination in your HR system opens the offboarding without waiting on a ticket.

Identity infrastructure you already run

On Team and Enterprise, SAML 2.0 SSO with JIT provisioning and a SCIM 2.0 endpoint plug PurpletGo into your existing identity provider instead of adding a second source of truth.

Evidence that holds up

Every revocation is logged with the time and the admin who ran it. On Team and Enterprise the log is hash-chained and verifiable, so the record of what was revoked, and when, is defensible in an audit.

Revoke the next leaver's access with proof

Access revocation and an audit log from day one.

Start free trial View integrations

30-day free trial - no credit card required