E
ELM Admin
Employee Lifecycle Management
GSuite sync healthy |
RP
Raul Plaza

Employees

Source of truth: Google Workspace · classification & local fields editable here

Employees
Pending
On leave
Non-employee
Failed access
Email Name Kind Role Department Phone State Access Updated

Orders

Work items raised from Zammad tickets · approve to apply

Pending
Approved (7d)
Rejected (7d)
Failed
Linked tickets
# Kind Target Requester Status Zammad ticket Created

Equipment

Devices from Kaseya RMM · multi-use is allowed for kiosks & shared stations

Devices
Assigned
Unassigned
Multi-use
Stale (>7d)
Hostname Asset tag Kind Model / OS Serial Assigned to Last seen Last user (Kaseya)

Google Workspace

Mailbox-level view from the Admin SDK + Gmail API · status, forwarding, delegation, groups

Mailboxes
Suspended
Archived
2-Step off
Auto-forwarding
Email Status 2-Step Last login Storage Forwards Delegates Groups

Windows file shares

Inventoried daily from the on-prem file server · access via direct ACE or AD group membership

Shares
Total grants
Direct ACEs
Last inventory
2026-05-08 06:00 UTC
UNC path Description Members Direct ACEs Last inventoried

Audit log

Append-only, mirrored to ElasticSearch

Time Action Employee Actor Detail

GSuite sync

Pulls the canonical user list and applies lifecycle changes

Schedule
Every 15 minutes
Next: 09:57 UTC
Last sweep
3 changes · 0 failures
2026-05-08 09:42 UTC
Cache
152 users tracked
152 GSuite · 0 stale
Recent sweeps
Started Duration Users Changes Failures

Role matrix

Which services each role gets — least privilege per spec §5

Role Drive Okta Azure AD QuickBooks VPN

Metrics

From spec §4 — sourced from audit + service logs

Provisioning success rate (24h)
98.4%
2 failures of 124 attempts
De-provisioning median time
42 s
p95: 1m 38s
Unclaimed accounts
3
Inactive > 14 days
Tool access violations
0
No alerts in 24h

Integrations

Credentials & connection settings for every system ELM talks to. Secrets are write-only — once saved they're never returned to the browser.

Privileged surface. Anyone with access here can read service accounts, API tokens, and pivot into any connected system. Gate /admin/ behind SSO before exposing.