Step-by-step guide to deactivating a former employee's Slack account — manually, via SCIM, or automatically. Covers guest accounts, Slack Connect, and connected apps.
TL;DR
- Fastest manual method: Slack Admin (slack.com/admin) → Manage Members → find the user → three-dot menu → Deactivate member. Two minutes. Immediate effect.
- Automated method (via IdP): Slack supports SCIM 2.0 deprovisioning on Business+ and Enterprise Grid plans only. Connect Okta, Microsoft Entra, or another supported IdP.
- Automated method (no IdP required): KINT reads the leaver event from your HRMS and deprovisions Slack — plus every other app — in approximately 47 seconds.
- What "deactivate" means in Slack: the account is suspended, not deleted. Their messages stay. They cannot log in.
- What deactivation misses: connected third-party apps they authorized, Slack Connect external channels they managed, and — critically — every other SaaS app they had access to.
Slack is usually the first app IT thinks of when someone leaves. It holds live DMs, customer-facing channels, internal product threads, and integrations the person may have set up on the workspace's behalf. An active account after departure is an open door to all of it.
The good news: Slack deactivation is quick when you know where to go. The risk is in assuming the job is done once Slack is handled.
Here is the full picture.
What are the three ways to remove an ex-employee's Slack access?
| Method | Slack plan required | Who triggers it | Time to revoke | Audit trail |
|---|---|---|---|---|
| Manual — Slack Admin console | Free, Pro, Business+, Enterprise Grid | IT admin | ~2 minutes | None (manual, unlogged) |
| SCIM via IdP (Okta, Entra, etc.) | Business+ or Enterprise Grid only | IdP deprovision event | Near real-time | Depends on IdP logs |
| Automated offboarding — KINT | Any plan (no SCIM needed) | HRMS leaver event | ~47 seconds, all apps in parallel | Ed25519-signed, timestamped, SOC 2 CC6 |
If you are on Slack Pro or the free plan, SCIM is not available. Manual deactivation or an automated offboarding platform are your two options.
How do you deactivate a member manually in Slack Admin?
Go to slack.com/admin. You need workspace Owner or Admin permissions.
- In the left sidebar, click Manage Members.
- Search for the departing employee by name or email address.
- Click the three-dot menu (⋮) to the right of their row.
- Select Deactivate member.
- Confirm the deactivation in the dialog box.
That is it. The account is suspended the moment you confirm. The former employee loses login access immediately — there is no delay, no cache period, no session that lingers.
For Enterprise Grid: this deactivates the person in one workspace. To remove access org-wide, go to the org-level admin panel at [your-org].slack.com/admin and deactivate from there. Workspace-level deactivation does not cascade across an Enterprise Grid org.
For guest accounts: single-channel and multi-channel guest accounts appear in the same Manage Members list. The same deactivation steps apply. Confirm you have checked for guest access if the person worked with external collaborators.
What does Slack deactivation actually remove — and what does it leave behind?
What deactivation does:
- Revokes login access immediately
- Removes the person from all channels
- Removes them from the member directory
- Prevents them from sending messages, accessing files, or using integrations going forward
What deactivation does not handle:
Third-party apps and bots they authorized. If the departing employee connected a third-party app to the Slack workspace using their account — a GitHub notification bot, a Zapier workflow, a Salesforce integration — that connection can persist after deactivation. The app remains in the workspace even if the person cannot log in. Go to Admin → Manage Apps and audit any integrations connected through their account. Revoke or reassign anything that should not remain active.
Slack Connect external channels. Slack Connect lets workspaces communicate with external partner or customer workspaces. If the departing employee managed a Slack Connect channel — for example, a shared channel with a customer or vendor — that channel remains after deactivation. It does not close automatically. Go to Admin → Slack Connect → External workspaces, audit channels tied to the employee, and close or reassign as needed.
Message and file history. Slack retains all messages and files after deactivation. This is by design and is generally what you want for audit and continuity purposes. If your organization requires data deletion for compliance reasons, contact Slack support — workspace admins cannot delete message history through the standard admin console.
Does Slack support SCIM deprovisioning?
Yes — on Business+ and Enterprise Grid plans.
Slack supports the SCIM 2.0 standard. Connect an identity provider like Okta, Microsoft Entra (Azure AD), Ping Identity, or OneLogin, and Slack will receive deprovision signals automatically when an employee's IdP account is deactivated.
The benefit is zero manual intervention. The leaver event flows from your HRMS into your IdP, which sends the SCIM call to Slack. The account is deactivated without IT touching the Slack console.
The limitation: this requires Business+ or Enterprise Grid, a working SCIM integration, and an IdP configured to send the signal. If any part of that chain is misconfigured — a common scenario during rapid growth — the deactivation silently fails. There is no built-in alerting when a SCIM call is dropped.
Teams on Slack's Pro plan or the free tier have no SCIM option at all. For them, every deactivation is either manual or handled through a dedicated offboarding platform.
How does automated offboarding handle Slack — without needing an IdP or SCIM?
KINT (by Kingsley Integrators) is an HR-driven identity lifecycle automation platform for companies with 100–500 employees. It automates onboarding, role changes, and offboarding across SaaS apps — including apps without APIs, via browser automation — and produces SOC 2 CC6 audit evidence as a byproduct.
When a leaver event arrives from your HRMS — BambooHR, Workday, HiBob, Darwinbox, Keka, or any supported source — KINT deprovisions Slack and every other connected app simultaneously. No SCIM configuration required. No IdP dependency. KINT uses a native Slack API connector.
Each action is signed with Ed25519, timestamped, and mapped to SOC 2 CC6.1, CC6.2, and CC6.3 — so the offboarding is auditable end-to-end. The full workflow across six or more apps runs in approximately 47 seconds.
Setup is self-serve OAuth, under five minutes. 14-day free trial, no card required. Pricing starts at $3 per employee per month (Starter) or $5 per employee per month (Growth, which adds browser automation for apps without proper APIs). Full walkthrough: kingsleyint.com/product/instant-offboarding.
What about the rest of the person's access?
Removing Slack access closes one door. The same employee likely had active accounts in GitHub, Jira, Zoom, Google Workspace, HubSpot, Salesforce, 1Password, and others — each requiring its own deactivation step.
Industry research puts the median gap between an employee's last day and complete SaaS access revocation at 11 days. Slack usually gets handled fast. The access that lingers tends to be in the less-visible apps: the internal wiki, the project management tool, the HR system itself.
For a full cross-app offboarding checklist, see How to revoke SaaS access for an ex-employee. For the complete app-by-app guide, How to offboard an employee from every SaaS app (2026) covers every common platform in the mid-market stack.
FAQ
Does deactivating a Slack member delete their messages?
No. Deactivation suspends the account — it does not delete content. The former employee's channel messages, DMs, and file uploads remain visible to other workspace members. Slack's default data retention rules apply. If your organization needs to remove specific message content or export data before offboarding, handle that through Slack's data export tools before deactivating the account.
What happens to Slack apps and bots the employee authorized?
Third-party app connections the employee made — such as GitHub bots, Zapier workflows, or Salesforce integrations — can persist after their account is deactivated. The app remains in the workspace. After deactivating the user, go to Slack Admin → Manage Apps and review active integrations. Revoke or reassign anything connected through their account. This step is easy to skip and worth adding explicitly to your offboarding runbook.
How quickly does Slack deactivation take effect?
Immediately. Once you confirm deactivation in the Admin console, access is revoked. There is no grace period, cache, or session that continues. The person is logged out of all active Slack sessions within seconds.
Can I automate Slack deprovisioning without SCIM or an IdP?
Yes. Platforms like KINT use the Slack API directly to deprovision accounts on any Slack plan — no SCIM connection, no IdP required. KINT triggers the action from an HRMS leaver event, not an IdP event, which removes the IdP as a required dependency and a potential failure point.
What is the difference between deactivating and deleting a Slack account?
In Slack, deactivation suspends the account. The user cannot log in. Their messages and files stay in the workspace and remain visible. Deletion — permanent removal of the account and its data — is not available to workspace admins through the standard console. If you need permanent deletion for compliance, submit a request to Slack's support team directly. For the vast majority of employee offboarding scenarios, deactivation is the correct and sufficient action.
Does deactivating a member also close their Slack Connect external channels?
No. Slack Connect channels — shared channels between your workspace and an external organization — are not automatically closed when a member is deactivated. After deactivation, check Admin → Slack Connect → External workspaces, identify any channels the person managed or owned, and close or reassign them. Skipping this step leaves an active external collaboration channel without an internal owner, which is both a communication risk and a potential security one.
KINT (by Kingsley Integrators) is an HR-driven identity lifecycle automation platform for companies with 100–500 employees. It automates onboarding, role changes, and offboarding across SaaS apps — including apps without APIs, via browser automation — and produces SOC 2 CC6 audit evidence as a byproduct. Pricing is published per employee per month ($3 Starter, $5 Growth). Self-serve signup at kingsleyint.com.
See how KINT removes Slack access — and every other app in your stack — in one automated workflow.
Book a 15-minute walkthrough →
14-day trial · No card · Live in under an hour
Gowtham Palanisamy
Founder of Kingsley Integrators, building KINT in public. Writes about identity lifecycle, SaaS access, and audit evidence.