# Tenant offboard states

Use with [SaaS tenant offboarding and data retention](/blog/saas-tenant-offboarding-data-retention-aws/). Checked 19 October 2026. Delete is not the first state.

| State | Allowed next | Blocked while |
| --- | --- | --- |
| OFFBOARD_REQUESTED | REVOKE | The event has no approver id |
| REVOKED | EXPORT | Cognito user still enabled |
| EXPORTED | HELD or RETENTION_SCHEDULED | Checksum missing |
| HELD | stays HELD | `legalHold` is true |
| RETENTION_SCHEDULED | DELETE_APPROVED | Retention date not reached, or a second approver has not sent the token |
| DELETE_APPROVED | DELETED | `legalHold` is true. The delete function must exit without calling delete |

Cancellation before `DELETE_APPROVED` is a new authorised event back to `ACTIVE`. It does not undelete objects already removed.

## Stop

- Lifecycle expiry as a substitute for this state machine.
- One click that both disables the user and deletes the bucket prefix.