Employee Offboarding Access Checklist: Closing Every Door When Someone Leaves
When an employee leaves, their access should end on their last working day, not weeks later. That means disabling their main account, revoking sessions and MFA devices, rotating any shared passwords they knew, removing admin rights and checking every application that sits outside your single sign-on. This checklist walks through each step, and shows why offboarding so often goes wrong.
Leftover accounts are a quiet but real risk. An ex-employee’s login may still work, an old account may be taken over by someone else, or a forgotten admin right may sit unused for years until it is found in an audit.
Why offboarding goes wrong
Most gaps come from the same few causes:
- No single list of what the person had. Access was added over the years and never recorded.
- Applications outside SSO. The directory account is disabled but a separate login in a SaaS tool stays active.
- Shared accounts. A password everyone knows is not changed when one person leaves.
- Hand-offs between HR and IT. The leaver date arrives late, or not at all.
- Privileged and service accounts. These are often forgotten because they are not on the person’s name.
Before the last day
- Get the confirmed leaving date from HR, and agree who in IT is responsible
- List all systems and applications the person uses, including admin roles
- Identify any shared passwords or accounts they know
- Agree who takes over their files, mailbox and responsibilities
- Decide on any early restrictions for sensitive roles or contentious exits
On the last day
- Disable the main directory account and, if you use single sign-on, confirm access to connected apps ends with it
- Revoke active sessions and tokens, so a signed-in browser or phone does not stay valid
- Remove MFA devices and registered security keys
- Disable VPN and remote access
- Recover or wipe devices, including laptops, phones and tokens
- Redirect or archive the mailbox according to your policy
- Remove admin and privileged rights. If you use privileged access management, also check vaulted credentials they could check out
In the first weeks
- Rotate shared passwords and service account credentials the person knew
- Check applications outside SSO, such as SaaS tools, supplier portals and cloud consoles
- Review vendor and partner portals where they were the named contact
- Transfer ownership of documents, repositories, scheduled jobs and API keys
- Recover licences so you stop paying for unused accounts
- Record what was done, with dates, for audit
Make it repeatable
A checklist is a good start, but manual processes miss things when people are busy. The fix is to build offboarding into your identity systems:
- One source of truth. Let your HR system trigger the leaver process so IT hears on the same day.
- Bring more apps under SSO. The more applications use one sign-in, the fewer separate accounts you have to chase.
- Automate provisioning and deprovisioning. Standards such as SCIM let your identity platform create and remove accounts in connected apps.
- Use roles, not one-off permissions. With role-based access control, access follows the job, so it is easy to remove and easy to review.
- Review access regularly. Quarterly or twice-yearly reviews catch what slips through.
All of this falls under identity and access management, which covers how accounts are created, changed and removed through their whole life.
Why it matters in the UAE
UAE frameworks such as the UAE Information Assurance Regulation, the DESC Information Security Regulation and the Personal Data Protection Law all expect organisations to control access to systems and personal data and to be able to show how. Prompt removal of leavers is one of the most basic pieces of evidence auditors look for. Which rules apply depends on your sector.
Want to stop doing this by hand?
We can assess your current leaver process, find the accounts that slip through and automate the clean-up. Talk to the CyberCop team.
Related Reading
More from our blog
- SSO vs MFA: What’s the Difference and Do You Need Both?
- PAM vs IAM: What’s the Difference and Which Do You Need?
Related services