Fractional IT for fast-growing companies
Blog Post
Leaving Rippling? You're not just swapping HR software. You're rebuilding SSO, MDM, device tracking, and license management. Here's the migration playbook.
.png)
You've decided to leave Rippling. Now what.
Leaving Rippling means more than picking new HR software. Rippling ties together login, devices, and licenses in one system. When you leave, that one system becomes many.
Your SSO splits out. Your devices need a new owner. Your licenses need reassignment. Your IT layer breaks into pieces.
We've guided dozens of startups through Rippling moves as part of our Bay Area IT support work. We know what works and what breaks. This checklist covers the IT work when you leave. Not HR work. Just what keeps your company going.
Rippling's bundled model works fine at 20 people. At 200, it creates friction.
Cost grows fast. A startup at 150 people often spends $25-40K/year on Rippling alone.
Device management is basic. You can't manage conditional access policies with the same precision as dedicated MDM, a common trigger for teams already using fractional IT services.
SSO is limited. Many startups hit walls when they wire Rippling to third-party apps that don't integrate natively.
Vendor licensing doesn't scale. Managing hundreds of SaaS licenses. Rippling's asset tracking falls short.
Vendor lock-in. Once Rippling owns your SSO and devices, extracting that data feels risky, especially when cybersecurity for startups work depends on clean access logs.
For scaling startups running our IT services for startups engagements, it's not if you'll leave. It's when. The answer: sooner than you think.
When you pick a Rippling alternative, you're not swapping HR software. Per Gartner, most big platforms fail when companies split their IT stacks. You're replacing four separate systems:
Most startup ops teams, even those backed by a fractional CIO, skip these. Then 30 days in, devices are still on Rippling, SSO is half done, and nobody knows who has licenses.
When Rippling runs your logins, every employee has a Rippling ID that opens all access. Slack, GitHub, Figma, cloud work. All through Rippling.
When you leave, that system ends. You're rerouting every app to a new login system.
Here's what the move looks like:
Week 1: List all apps on Rippling SSO. Pull every application connected to Rippling login. Note each one: SAML or OIDC. Does it support access rules. Custom setup. Which apps are critical on day one.
Week 2: Add users to your new login system. If you use Microsoft Entra ID, sync users from your new HR software to Entra. For Okta, do the same. This is where you want expert help. Bad sync creates fake accounts and lockouts.
Week 3: Switch each app one at a time. Update each app's login to use your new system instead of Rippling. Make new SAML certs. Update URLs. Test with a test user first. Start with non-critical apps (Notion, Figma, project tools). Move to critical work (GitHub, AWS, VPN) last.
Week 4: Turn off Rippling SSO. Only after every app is switched should you shut off Rippling login.
Timing varies. 50 apps takes 6-8 weeks. 15 apps takes 3-4 weeks. Most startups guess wrong by half.
Rippling's MDM controls signup, rules, and app push for devices. When you leave, a new platform takes over. It's not just tech. It's org change.
With Rippling, HR could enroll a device, push rules, and wipe it if someone quit. With a real MDM like Microsoft Intune or Jamf, IT owns it. If you don't have an IT team yet, you need one now.
Device enrollment: Before you move, decide your enrollment method. Does IT manage devices full-time (MDM), or do employees manage them with IT help (MAM), or both. That choice picks your new MDM.
Most startups use full MDM: Macs and Windows from IT, plus managed iPhones and Androids for company phones. Once you decide, re-enroll every device. It's usually invisible to staff (old profile off, new one on). But it needs timing. Enroll by team or shift, not all at once.
Rules and security: Rippling had basic rules: passwords, locks, app blocks. Your new MDM has more power. Define "safe" for your org. Most startups want:
Roll rules out slow. Start with basics. Then tighten. Too strict and staff will find workarounds.
App push: Rippling could auto-push apps. Your new MDM can too. But setup takes work. Decide what's required (push to all), optional (self-service), or blocked (not allowed).
For most startups:
We do this during MDM moves. It's detailed work. Easy to mess up.
Rippling kept a full list: who owns each device, when issued, OS type, rules, retire date. Auto-tracked. Rippling saw every signup.
When you leave, you own that list. It's critical.
A device list helps you:
Most startups do this badly. They assume MDM keeps track auto. It does, but only for active devices. A staff member uses a personal phone for work. It won't show up unless it's in MDM. Same for contractor devices or personal devices.
The best way: keep a separate device list in a spreadsheet or database. Record:
Update whenever you issue or retire a device. You'll need this for audits, license claims, and future compliance work.
With Rippling, it's simple: Rippling bills per seat. You pay. Done.
After Rippling, you manage many licenses at once. Microsoft Entra, Intune, your new HR tool, your MDM. Each has its own model. All tied to headcount.
Here's the mess:
The fix is a license audit map. Document:
One person owns it (ops lead or fractional CIO). Update each quarter. You'll find $10-20K in annual savings by cutting unused licenses. We can audit and tune your vendor stack. It pays for itself.
Use this as a template. Adjust timing based on your current stack and how many apps you have.
Pre-move (2-4 weeks)
Migration work (4-8 weeks)
Cutover (1 week)
Post-move (ongoing)
A Rippling move is technical but not hard. If you have an IT person who's done migrations, they can run this with outside help. G2's method helps pick platforms for your needs.
Most startups don't have that skill in-house. And the move is time-sensitive. Three months of partial work is worse than two weeks of focused expert work.
We help startups with Rippling moves: login setup, MDM work, device enrollment, vendor tuning. We've seen what works. We can compress a six-month ad-hoc job into four weeks of structured work.
Leaving Rippling and want to skip the usual problems. We can help. Tell us your timeline and we'll scope it.
Can I run two login systems at once?Yes, but for a short time. You can add users to your new system and run both for a few days to test. Running them together for weeks makes duplicate accounts, password mess, and confusing logs. Pick a cutover day and stick to it.
What about users disabled in Rippling?If they still work there, re-enable them in your new system. If they left, don't add them. Some startups accidentally turn on old contractor accounts during moves. Check your list before you add anyone.
Do all devices re-enroll?Yes. Old profile off, new one on. It's usually invisible to staff. A 15-minute task when they log into Wi-Fi. Enroll by team to avoid failure.
How much downtime?Very little if you plan right. Login switch should be seamless if you reset apps first. Device work happens in background. Worst case: a few minutes lost if someone's device is switching when they log in. Rare.
What about personal devices for work?If Rippling was controlling it, it needs removal and won't auto-join the new system unless they re-enroll. If it's bring-your-own-device and Rippling didn't touch it, nothing changes. It works if it has network and SSO works.
Need a device list spreadsheet?Yes. Your MDM shows enrolled devices, not devices not enrolled, devices in repair, or held devices. A master list is key for compliance, audits, and exits. Update monthly.
What's the cost?New login platform. Okta: $2-4 per user per month. Entra ID: free with Microsoft. New MDM. Intune: $4-6 per device per month. Jamf: $8-20. New HR software: usually $8-20 per staff per month. Expert help: We charge $15K-25K for full move for 100-300 person startup, based on complexity.
Most IT firms wait for things to break. We learn your roadmap before they do. Every Rippling migration engagement at Network Right starts with one dedicated expert who knows your stack, your people, and where you're headed.
Here's what that looks like in practice. Your team Slacks a real human. They answer in minutes. They already know your setup, so the fix is fast. Then they flag what's coming next, before it becomes a fire.
Startups use us to split Rippling into separate SSO, MDM, and HRIS tools. Later-stage teams lean on us for multi-vendor coordination. The same dedicated expert stays with you the whole way, from your first 10 employees to your first 500.
That's how IT starts feeling in-house. Because in every way that matters, it is.
Proof in the numbers:
Ready to stop managing your IT vendor and start building your company? Book a 20-minute call. We'll walk through your stack, your pain points, and exactly how Rippling migration fits. No jargon, no pressure. Just a real conversation with a real engineer.
