IT ISSUE · IDENTITY AND ACCESS
Departing employee access removal
The last day is not the risky moment. Access does not expire on its own.The last day isn't the risky moment. The months afterwards are, because access doesn't expire on its own and nobody is watching an account that no longer has a person attached to it.
What usually needs checking
- The account itself, and any sign-in sessions still active.
- Mail forwarding or delegate access set up for cover.
- Shared mailboxes, calendars and group memberships.
- Devices, and whether they came back.
- Licences that are still being paid for.
- Logins with outside vendors that were never in your systems.
The list is always longer than the handover said
We work through the accounts, sessions, devices and access we can see, and confirm what should be kept, transferred or closed rather than removing everything and breaking something a colleague relied on.
The last item on that list is the one that causes trouble. Vendor portals, an industry body login, a courier account, a domain registrar: access arranged directly by the person who left, in their own name, in systems we were never told about. We can't remove what we have never seen, so the useful question on the day someone resigns isn't what they had, but who else they ever signed up with.