Automated joiner, mover, leaver
JML for every app. API, SCIM, or neither.
Your identity platform automates JML for the apps with SCIM or an API. The rest, often the sensitive ones, run on tickets and shared logins.
What the rest of the stack cannot reach.
StitchOps completes the lifecycle in the apps your directory cannot reach. One workflow can cross an API step, a SCIM-managed app, and a portal that has neither, and return evidence for all three.
Joiner
Accounts, roles, and groups created in closed apps the day the directory creates the user.
Mover
Role changes applied in vendor portals and thick clients when the directory moves the user, with the old access removed.
Leaver
Sessions and access revoked in every closed app when the directory disables the user, with a confirmation gate before each destructive step.
One workflow across all three kinds
API actions for the apps that have one, a directory step for the ones with SCIM, browser and desktop steps for the rest.
How it works with your stack.
Step 1
The directory event fires
Okta, Entra ID, or JumpCloud creates, changes, or disables a user.
Step 2
StitchOps runs the change everywhere
The agent on your worker VM makes the change in the closed apps with vaulted credentials, step by step.
Step 3
Evidence returns
Each app's result and evidence references go back to the ticket, the audit log, or the assistant that asked.
How it runs
Described once. Replayed every time.
Tell Stitch the task, review the typed steps, and save it. The agent runs it on a worker VM in your environment with a vaulted credential, and logs every step.
See the platform →What you can finally automate.
Offboard a user from closed apps after the directory disables them
Provision roles that an app's SCIM does not cover
Apply a transfer in the thick client and remove the old role
Verify access was actually removed and capture the evidence
Bulk-remediate orphaned accounts from a spreadsheet
Governance
Ask for it in plain language.
Claude, ChatGPT or Copilot can run these from your existing assistant. The model picks from typed tools; the agent owns the credentials and stops for confirmation on anything destructive.
Connect your assistant →I found a saved workflow for this. Running it on worker-01.
tool call
workflow_offboard_closed_apps
{ "email": "j.doe@example.com" }
Confirmation required
Step 5 deactivates the user in vendor-portal. This cannot be undone by the workflow.
completed in 5.2s
3 portals · 6 steps · evidence: step_05.png, step_11.png, step_17.png
Done. The user is removed from all three portals. Evidence is attached to run_01j8k.
The SCIM tax
Many apps offer SCIM provisioning only on their most expensive plan, charged on every seat. See what that costs your team, or check SCIM pricing by app.
Start with one workflow that never had an API.
Fifteen minutes on your top three manual processes. We tell you which one to run first.