Who has access after someone leaves the company?

When someone leaves the company, the visible part of the process is simple: they hand over the laptop, the contract is closed, the handover is made and the team goes on.

The invisible part is more dangerous. What access remained active after departure?

An old GitHub account, a role in a cloud project, an invitation to a workspace, a personal API key, or a local account in an app can remain active long after the person is no longer part of the organization. There is no need for malicious intent to make this a problem.

That’s why offboarding should not be treated as a mere HR list. Security and Identity Control.

The problem is not the account you know. It is the account you forgot

Most organizations disable the main account: Microsoft 365, Google Workspace or the central identity provider.

That is necessary, but it does not prove that access has disappeared everywhere.

In a real SaaS stack, a person can have separate access to:

• repositories and organizations GitHub;

• Cloud platforms and administrative consoles;

• CRM, help desk and ticketing systems;

• billing and payment processors;

• observability and analytics platforms;

• Design, product management or collaboration tools;

• Hosting, DNS and Domain Management

• local accounts created before the introduction of SSO;

• API keys, personal access tokens and credentials saved in automation.

Some of these accesses disappear through SCIM or SSO.

Here is the difference between offboarding administrativ and offboarding verificat.

What should happen on the day of departure

A mature process starts from a clear event: the person no longer needs to have access after a certain moment.

The flow can be thought of in five steps:

1. Identify the person and associated identities. Main email, alias, administrative accounts, secondary accounts and identities used in external applications.

2. Remove the central access. Deactivates the main account, active sessions, MFA factors and identity provider-controlled tokens.

3. Inventory access from connected applications. Check who still appears in the relevant access sources.

4. Make a decision for each entry. Revoke, temporarily retain with justification or escalate to the system owner.

5. Keep the evidence. Who checked, what found, what decided and when the action was closed.

The final point is the one that turns the process from “we think we have removed access” to the evidence.

Access review is the post-offboarding check

An access review doesn’t have to mean a giant spreadsheet sent quarterly to all managers.

For offboarding, it can be much more precise: you generate a campaign or check focused on the person leaving and the systems in which it appears.

For each access, the reviewer must be able to answer a simple question:

Is there another legitimate reason for this identity to be accessed here?

In special cases — for example, a mailbox to be kept for continuity or a technical account that does not actually belong to the person — the decision must be documented and transferred to an active owner.

Automating starts with the right trigger

The most common problem is not that the team doesn’t know how to do an access review. It’s that nobody remembers to start it at the right time.

A good process can be triggered by:

• Change of status in a HRIS;

• disabling the user in the identity provider;

• a webhook from an offboarding workflow;

• a manual action initiated by HR, IT or security.

From there, automation can prepare the access list and create the necessary taskuris. However, access is still a human decision.especially for privileged roles or exceptions.

Automation should reduce mechanical work, not hide responsibility.

Nu confunda user accounts cu service accounts

Offboarding brings to the surface another common problem: technical resources created by one person but used by the system.

If a token, integration user, or service account depends on an employee’s identity, their departure can disrupt production if you simply delete everything.

Before the revocation:

• identify human access versus technical access;

• transfer ownership of technical resources to an identity controlled by the organization;

• rotates the secrets that have been known to the person leaving;

• verify whether automation uses personal credentials;

• document the exceptions and the time limit for their removal.

A service account is not an excuse to keep a personal account active.

What Auditors Want to See

For SOC2 or ISO/IEC 27001, the value is not in a screenshot that shows that a user is “disabled”.

A good evidence can show:

• date of departure;

• sistemele verificate;

• the revisor and the owner;

• The access found.

• the decision for each access;

• time of revocation;

• exceptions and their justification;

• confirmation that the taskuris have been closed.

This is much more powerful than a generic policy that only says “access is revoked upon termination”.

What is automated and what is not

and automated:

• collection of users from applications;

• comparison of identities;

• crearea review-ului;

• Notifications and reminders;

• evidence of time and actor;

• escaladarea taskurilor restante.

Maintain human control for:

• acces privilegiat;

• the exceptions;

• conturi tehnice neclare;

• transferul ownership-ului;

• the final approval that the offboarding is complete.

This separation produces a quick process without turning a security decision into an automated checkbox.

Un test simplu

Choose the last person who left the company and look for it in five systems that you consider critical.

If it still appears active in one of them and there is no documented justification, you have found exactly why offboarding should be linked to access review.

If it does not appear anywhere, ask the second question: Can you tell me how you checked it?

Operational security needs both responses: access to be removed and the process to be verifiable.

To see how identity, controls, evidence and reviews are linked into one program, see Compliance platform ZebraByte.