by Quick answer: Disable the person’s accounts now, then work outward: revoke sessions and tokens, change shared credentials, check what they accessed, and fix the offboarding process that let it happen. Do not wait for a full investigation before cutting access.
Step 1: Cut access immediately
- Disable the main identity. Suspend their account in your directory or identity provider first, which blocks anything using single sign-on.
- Revoke active sessions and tokens. Disabling an account does not always end sessions already open. Force sign-out and revoke refresh tokens and app passwords.
- Remove MFA devices and trusted devices registered to their account.
- Disable VPN, remote-access and email forwarding. Check for mailbox rules that forward messages elsewhere.
Step 2: Deal with shared and local access
- Change any shared passwords they knew: admin consoles, social accounts, Wi-Fi, vendor portals.
- Rotate API keys, SSH keys and service-account secrets they could access.
- Remove them from code repositories, cloud consoles, SaaS apps that sit outside SSO, and third-party tools.
- Recover company laptops, phones and security keys, and remotely wipe where appropriate.
Step 3: Check what happened
Review logs for the period since they left, and for the weeks before they gave notice:
- Sign-ins after the departure date, and from unusual locations
- Large downloads, exports or file shares to personal accounts
- New accounts, forwarding rules, or permission changes
- Access to customer or financial data outside their role
If you find signs of misuse, preserve the logs and involve legal counsel before taking further action.
Step 4: Find the root cause
This usually comes down to one of these:
- No single offboarding checklist, so HR, IT and managers each assume someone else did it.
- Apps outside SSO that need manual removal.
- Shared accounts that nobody owns.
- Contractors and vendors who are never in the HR system.
- Slow notification: IT hears about the departure days late.
Step 5: Fix it permanently
- Centralise logins with SSO so one action removes access to many apps.
- Link HR events to account changes so access ends automatically on the last day.
- Run a quarterly access review where managers confirm who still needs what.
- Eliminate shared accounts, or vault and rotate them.
- Keep an inventory of every application and who administers it.
Why it matters beyond security
Lingering access is a finding in many audits. SOC 2, ISO 27001 and HIPAA all expect timely access removal, and auditors will sample leavers to check it.
An offboarding checklist by system
Use this as a starting point and tailor it to your environment. Assign each line to a named owner so nothing is “someone else’s job”.
| System | Action | Typical owner |
|---|---|---|
| Identity provider / directory | Disable account, revoke sessions and tokens, remove MFA devices | IT |
| Email and calendar | Convert to shared mailbox or forward internally, remove external forwarding rules, set auto-reply | IT |
| VPN and remote access | Disable accounts and certificates | IT / Security |
| Cloud consoles (AWS, Azure, GCP) | Remove IAM users and roles, rotate access keys | Engineering |
| Source code and CI/CD | Remove from organisations, revoke personal access tokens and deploy keys | Engineering |
| SaaS apps outside SSO | Remove users, transfer ownership of documents and workflows | App owners |
| Shared credentials | Rotate passwords and API keys the person knew | Security |
| Physical access | Collect badges and keys, disable door access | Facilities |
| Devices | Collect or remotely wipe; revoke device certificates | IT |
| Finance and vendors | Remove bank, card, procurement and payroll approvals | Finance |
Timing: when each step should happen
Before the departure date
- HR notifies IT as soon as notice is given or the decision is made.
- For sensitive roles, plan a handover and consider reducing access to critical systems during the notice period.
- Back up and preserve data the person owns so it is not lost when the account is removed.
On the last day
- Disable accounts at an agreed time, coordinated with the exit meeting for involuntary departures.
- Collect equipment and credentials.
- Remind the person of confidentiality obligations.
In the first week
- Review logs for sign-ins, downloads and sharing since notice was given.
- Reassign ownership of accounts, files, tickets and automations.
- Rotate any shared secrets the person had access to.
At 30 days
- Confirm no active tokens, OAuth app grants or API keys remain linked to the identity.
- Delete or archive the account according to your retention policy.
Risk differs by type of departure
| Departure type | Main risk | Special handling |
|---|---|---|
| Voluntary resignation | Data copied to join a competitor | Monitor data exports during notice; plan handover |
| Involuntary termination | Retaliation, sabotage, deletion | Disable access at or before the conversation; escort and device handling |
| Contractor or vendor end | Forgotten accounts outside HR systems | Set expiry dates when the account is created |
| Internal transfer | Accumulated, unneeded access (“privilege creep”) | Re-certify access at role change |
Evidence and legal considerations
If you suspect misuse, take a methodical approach. Preserve logs and snapshots before changing anything, restrict who knows about the investigation and involve HR and legal counsel before contacting the former employee. Depending on the data involved, you may have regulatory notification duties, and employment agreements, confidentiality obligations and trade-secret laws may offer remedies. Good records of when access was removed also protect you if access is later challenged.
Measuring whether offboarding works
- Time to revoke: hours between the departure and account disablement
- Orphaned accounts: active accounts that do not match a current employee or contractor
- Percentage of apps covered by SSO, since those can be removed in one step
- Audit sample pass rate: leavers whose access was fully removed on time
Run a quarterly reconciliation of HR records against your directory and your top SaaS apps. It is one of the fastest ways to find lingering access before an attacker or an auditor does.
Special cases people forget
OAuth grants and third-party app access
If the former employee authorised a third-party app to read email or files, that grant can survive an account disablement in some platforms. Review enterprise application consents and revoke any tied to the departed user, especially those created by administrators.
Personal devices and unmanaged accounts
Staff may have company email or files on personal phones, personal cloud storage or messaging apps. Use mobile application management to wipe company data only, and ask the person to confirm deletion in writing for any copies they hold.
Shared mailboxes, distribution lists and calendars
Remove the person from groups and lists, and check calendar invites that expose meeting links or recurring access codes.
Customer-facing and vendor portals
Account managers and support staff may hold logins to customer systems and partner portals. Keep a list of these external relationships so they can be reassigned and credentials changed.
Domain registrar, DNS and certificates
Technical staff sometimes hold registrar or DNS accounts personally. Make sure these are owned by a role-based company account with MFA.
A short incident example
Consider a 40-person company where a sales engineer resigns on good terms and leaves on a Friday. HR tells IT on Monday. IT disables the person’s single sign-on account, but the individual’s login to the company’s customer-support portal, which sat outside SSO, stays active. Three weeks later the account is used from a home IP address to export a list of customer contacts. Nothing malicious was intended by the company, but the data left anyway, and the incident now needs legal advice, a customer notification assessment and a harder look at every application outside SSO.
The root cause was not a sophisticated attack. It was a gap between a notification arriving late and an application inventory that nobody had kept up to date. Both are fixable with simple routines, which is the real lesson: offboarding is an operations problem, and the cheapest control is a living list of every system that holds an account for each person, reviewed whenever someone leaves.
Questions to ask your team this week
- When someone leaves, who is told, how quickly and by what method?
- Do we have a single list of every application and who administers each one?
- Which applications are not connected to single sign-on?
- When was the last time we compared HR records with active accounts?
- Who owns the shared passwords and API keys that a leaver might know?
Answering these questions honestly will tell you quickly whether you have a process or a hope.
Frequently Asked Questions
How fast should access be removed?
For voluntary departures, by the end of their final day. For involuntary ones, at or before the moment they are told.
What if the employee has already used the access?
Preserve evidence, contain access, and speak to legal counsel. Depending on the data involved, you may have notification obligations.
Do we need special software for this?
Not to start. A written checklist and an owner help a great deal. Identity tooling makes it reliable as you grow.
Should we delete a former employee’s account immediately?
Disable first, delete later. Disabling blocks access immediately while preserving data and audit logs. Delete or archive after your retention period and after ownership of files and automations has been transferred.
How do auditors check offboarding?
They usually take a sample of leavers from HR records and ask for evidence that accounts were disabled promptly. A ticket or automated log with timestamps is the best evidence.
What if a contractor’s account is not in our HR system?
Give every contractor an account with an expiry date and a named internal sponsor, and review contractor accounts monthly.
Want offboarding that doesn’t depend on someone remembering?
We help automate access removal and run access reviews. Explore our identity and access management services →
