Offboarding Is a Security Control Most Companies Run by Email

The termination ticket says Friday. The HRIS record says Friday. The helpdesk disables the Active Directory account and deactivates the identity provider at 5:12 pm. The ticket closes. The Expensify account is still active. The AWS root email, which happens to be the departing director’s personal Gmail, is still active. The GitHub organization still lists them as an owner. The ticket is evidence that the assigned steps were done. It is not evidence that the access is gone.

Single sign-on solves the access problems you know about. It does nothing for the access you didn’t provision. The identity provider is a doorway. The estate is the building behind it. Disabling the user kills the SSO session. It does not revoke the refresh token, the OAuth grant, the API key, the personal access token, or the device sync. An OAuth token doesn’t care if the employee’s badge still works.

The corporate credit card is the most prolific shadow IAM tool in the enterprise. An engineering manager expenses a specialized monitoring tool. They are the sole tenant admin. They invite their team using local usernames and passwords. When the manager leaves, the subscription continues billing to the corporate card. IT has no record of the tenant, no admin rights, and no way to trigger deprovisioning. Access that was never provisioned through IT will never be deprovisioned by IT.

A departing employee’s mailbox is the most complete inventory of company SaaS you will ever get. Account-creation emails, welcome messages, password resets, invoices, and renewal notices all land there. It is also usually deleted on the last day, by the same ticket that closes the account. The mailbox is the inventory, and the ticket deletes it. Search the inbox for welcome messages, verification links, and subscription notices before you wipe it. This is the cheapest discovery mechanism in the program.

Contractors rarely resign. Their purchase orders just expire. Employees have an HR termination event that triggers the identity lifecycle. Contractors do not. Their access is sponsored by a manager, scoped by a statement of work, and ended by a spreadsheet. When the sponsor leaves, the contractor’s end date becomes a fact nobody owns. If the only trigger is HR, then anyone who isn’t in HR is permanent. Give contractors an identity in the same system as employees, with a named sponsor and a hard end date. Assume the staffing agency will not tell you when the work ends.

The person who knows where all the access is, is the person leaving. The notice period is the only window you have to ask. Most organizations spend those two weeks on knowledge transfer and none of it on access transfer. Sit them down for thirty minutes. Ask what tools they use, what they signed up for with a work email, what is in their password manager, and what vendor portals they administer. The exit interview is thirty minutes with HR. Nobody from IT is in the room, and the person’s password manager has a hundred and forty credentials in it.

The hardest access to remove often doesn’t belong to the departing person at all. It belongs to a shared login they knew. Nobody provisions a shared account. Everybody uses one. The team vault’s master password was known by five people. Two have left. The rotation was scheduled for last quarter. The break-glass account has a person’s name on it, and that person is on a beach. Enumerate the shared accounts, assign an owner, put them in a vault, and rotate the credentials on offboarding.

Vendor portals present a similar problem. The domain registrar account is tied to the personal Gmail of a web developer who left three years ago. The domain is up for renewal in forty-eight hours. The vendor refuses to transfer ownership without authorization from the departed email address. Require role-based email aliases for all external vendor portals, domain registrars, and support accounts. Never register infrastructure to an individual’s inbox.

A departing sales director hands in their corporate laptop. They walk out the door, open their personal iPad, and continue reading the live pipeline because the session token in their mobile app hasn’t expired and the company doesn’t enforce conditional access policies for device compliance. You can revoke the device token. You cannot wipe the local copy on an unmanaged personal device. Assume the data is gone and act accordingly. The control is preventing the sync in the first place, not recovering it after.

HR doesn’t enter the termination until the last day. The resignation was known for two weeks. The exposure window is the notice period plus whatever the ticket queue adds. The manager tells HR, HR tells payroll, payroll runs on a semi-monthly cycle, and IT gets a report. The person’s last day and the report date are not the same date.

Access reviews are a backstop, not a control. A director signing two hundred rows in eleven minutes is a signature, not an attestation. The review that matters is the reconciliation nobody wants to run. Take the HR terminated list for the last two quarters. Compare it against the identity provider’s active users. Compare that against the user lists from your top twenty applications by data sensitivity. The third diff is where you find the shadow estate. Treat the output as a work queue, not a report.

Disable the account before deleting it. Preserve the mailbox long enough to run the discovery search. Set a deletion clock for thirty or sixty days and hold it. The failure mode is the disabled account that gets re-enabled because a new hire has the same name, or because a manager asks for a transition extension that never ends.

Tie expense reporting directly to identity management. If a business unit expenses software, the vendor must support single sign-on, and the configuration must go through IT. Enforce hard expiration dates on all non-employee accounts in the directory. If a contract is extended, the sponsor must manually renew the access before it drops. Audit OAuth grants tied to corporate identities and restrict the ability of end-users to authorize third-party applications without admin consent.

Every offboarding is a discovery project that someone budgeted as a checklist. The offboarding checklist is a list of systems. The risk is a list of relationships. You can’t deprovision what you can’t enumerate, and most enterprises can’t enumerate. A closed ticket records that the assigned steps were done, but it does not prove the person can no longer reach the data.