How to Remove Access Safely When an Employee Leaves

Disabling a primary account is important, but it may not revoke every path into business systems. Active sessions, cloud roles, personal access tokens, shared passwords, mobile devices, and vendor portals may remain active. A reliable offboarding process maps identities to services and assigns an owner for each removal step.

Coordinate the timing

Confirm the effective time with HR and the manager, then identify systems, groups, devices, and privileged roles associated with the person. Preserve records and transfer business data according to policy before access is removed. For high-risk departures, coordinate the sequence so credentials and sessions are revoked without leaving unattended access.

• Disable identity provider and directory accounts and revoke active sessions.
• Remove cloud, VPN, source control, SaaS, and vendor access.
• Rotate shared secrets or API keys the person could access.
• Recover or remotely manage company devices under approved policy.
• Verify completion and record exceptions with an owner and deadline.

Informatix Systems lists identity and endpoint security related services. An access review can help map joiner, mover, and leaver controls across systems. Contact Informatix Systems to discuss access lifecycle gaps.