IdentityCheck which app accounts it can remove

Who should buy Torii Identity?

Torii combines identity governance with discovery signals from direct integrations, identity and SSO systems, finance data and an optional browser extension. Its discovery help explicitly distinguishes discovering a user's app account from observing usage. A browser visit does not prove that the employee has an account in that app.

It is a weaker purchase if Entra already manages the relevant accounts and app owners can show that departing employees lose access. It is also a poor buy for an organisation that will not appoint app owners, resolve unknown accounts or maintain offboarding methods as the organisation adds and removes apps.

Torii's current pricing page separates Identity Governance & Administration, SaaS Management and AI Management scopes. Ask which products the quote includes: access governance, SaaS discovery and renewals, or both. A feature shown in the demo may belong to a separately priced product.

What does “offboarded” actually prove?

Torii's IGA product page makes a broad last-day revocation promise. Its offboarding help describes what each offboarding method actually does. An owner can mark a task done without removing the app account.

For each high-risk app, test the removal action, the resulting account state and any session opened before the employee left. If Torii ignores an app, assign someone to remove access through another system.

Can an Entra-led employer rely on a real-time exit?

Torii's real-time offboarding guide names Google Workspace, Okta and BambooHR for its App Event trigger. It says integrated-app information otherwise syncs every 24 hours and state-based workflow triggers can take up to an hour even when some attributes update in real time.

For BambooHR, the immediate-termination event is a beta path; future-dated terminations follow a different route.

That document does not list Entra as an App Event source. Other Entra integrations or custom methods may exist; this document does not establish them.

In an Entra-based trial, make Torii demonstrate the exact HRIS-to-Entra-to-Torii event and elapsed time with your proposed licences. Keep an emergency directory and app-side revocation route outside the scheduled workflow until it passes. Microsoft itself says Entra cannot directly revoke a token issued by another application.

Check access between employee departures

Torii's Access Governance instructions can compare intended access with connected app roles or IdP group membership, show deviations, assign app owners and choose monitoring, tasking or automatic remediation. Use this to find employees whose current app permissions differ from your policy, including those who have changed jobs internally.

For an app without a direct integration, governance may be based on IdP groups or uploaded data rather than the app's own role state. A deviation can close because a policy is changed, disabled or its integration disconnected, not solely because somebody's access changed.

Torii's remediation guide says automatic group-based fixes may fall back to a task for manually assigned app access. For a policy-deviation task, Torii checks the policy again after the owner marks it done. Confirm that this check applies to the workflow you are buying.

We would roll out governance with remediation set to None, validate deviations with app owners, then use tasks before enabling app-by-app automatic fixes. That sequence follows Torii's documented recommendation. Start with one sensitive app: change a test employee’s role, run the fix and check their permissions in the app.

What should a Torii quote contain?

Torii does not publish a price for this 500-person Identity purchase.

Its subscription guide ties Basic licensing to employee count, but Professional and Enterprise billing can differ. Request the counting rules for the Identity package you would buy.

Request the complete annual price and renewal terms for 500 employees plus the actual contractor and inactive-user treatment.

Have the quote list each included product and service:

• Identity Governance and any SMP discovery, finance or renewal features.
• Browser extension deployment, app integrations, action rights and custom actions.
• Data import, implementation, support and extra environments.

Ask who maintains each connector and the cost of an integration that needs work beyond the standard action. Estimate how much time your app owners will spend maintaining these actions, then add that work to the software cost.

Five account-removal tests to run before buying

Use fictional identities and test content only. Capture event time, Torii action log, app account state, session result and exception owner. These are proposed tests; we have not run them in Torii.

If Torii finds accounts but cannot remove them, ask for a separate discovery and governance quote. If Entra and changes within the apps pass all five tests, keep that setup.

When should the buyer choose something else?

For a mostly Microsoft-managed estate with limited unmanaged SaaS, test Entra ID Governance first and fill app-side gaps; Torii may add cost without removing any more accounts.

For a Google-centred team buying workflow automation and file governance, put BetterCloud User Automation into the same trial.

If one small IT team owns device assignment and access, compare Josys.

Our seven-route offboarding guide covers the broader shortlist. Buy Torii if the trial shows it can find and remove app accounts that your existing tools miss.

Questions buyers ask