The Departure Date Is Not the Access Date: Closing the Offboarding Gap
Photo: DHSgov, Public domain, via Wikimedia Commons
When an employee leaves, HR records a departure date and IT disables the email account. The ticket closes. The access footprint often does not. Former staff can retain entry through shared credentials, forgotten SaaS trials, personal devices, and accounts created outside the identity provider. The gap between the departure date and the access date is where security incidents begin.
The Hidden Footprint of a Departing Employee
Most organizations have a formal offboarding process for the accounts they know about. The problem is the accounts they do not know about. A marketing manager may have created a project management account with a personal email. A sales representative may have stored credentials in a shared spreadsheet. A developer may have generated an API key for a side integration and never added it to the central inventory.
These are not exotic scenarios. They are the normal residue of distributed software adoption. The employee may not intend to keep access. The account simply outlives the person's employment because no system connects the departure event to the account.
Why Email Revocation Is Not Enough
Disabling email is necessary but insufficient. Email is one identity among many. SaaS applications often authenticate through the corporate identity provider, but not always. Some tools have local accounts, invitation-based access, or shared team credentials. A former employee may still be able to log in to a project workspace, a billing portal, or a customer support tool even after email is disabled.
The risk is not only malicious. A former employee who retains access may receive sensitive notifications, appear in audit logs, or be counted as a licensed user. In regulated industries, that can create compliance exposure. In any industry, it creates uncertainty about who can see what.
Map the Access Footprint
A repeatable offboarding process begins with an access map. For each role, identify the systems the employee can access, the authentication method, the owner of the system, and the revocation procedure. The map should include the identity provider, single sign-on applications, local accounts, shared credentials, API keys, and physical access.
The map does not need to be exhaustive on day one. It needs to be maintained. Start with the systems that hold customer data, financial data, or administrative privileges. Add others as they are discovered. The exercise itself often reveals shadow IT that no one had cataloged.
A Repeatable Offboarding Checklist
A practical checklist has four phases.
-
Before the departure date. HR notifies IT and the business owner as soon as a departure is confirmed. The business owner identifies systems that may not be connected to the identity provider. IT prepares a list of accounts, groups, and credentials associated with the employee.
-
On the departure date. Disable the primary identity, revoke active sessions, and rotate any shared credentials the employee could access. Transfer ownership of files, mailboxes, and project workspaces. Remove the employee from distribution lists and approval chains.
-
Within 24 to 72 hours. Review SaaS usage reports for the employee's accounts. Check for local accounts, API keys, and personal email invitations. Confirm that licenses have been reclaimed or reassigned. Review access logs for unusual activity.
-
Thirty days after departure. Conduct a follow-up audit. Confirm that no account remains active, no shared credential is unchanged, and no license is still assigned. Update the access map with anything discovered.
Shared Credentials Are the Weak Point
Shared credentials deserve special attention. A team password for a vendor portal may be known to several people, including the departing employee. If the credential is not rotated, the departure process is incomplete. The same applies to API keys, service accounts, and integration tokens.
Organizations should reduce shared credentials wherever possible. Where they cannot, they should maintain a record of who has access and rotate credentials when someone leaves. A password manager can help, but only if it is integrated with the offboarding process.
Measure the Gap
The most useful metric is the time between the departure date and the last active access. A business that can measure that gap can manage it. A business that cannot is relying on trust.
Offboarding is not an HR formality. It is an access control process. The departure date is a date. The access date is a decision. The two should be the same.
