Remove Employee Access Before the Last Day Ends
Matthew Leo · Published October 23, 2026 · Guides
An employee departure is not complete when the laptop comes back. The organization must close every route into its systems, transfer ownership of business data and keep enough evidence to prove the work was done.
The sequence matters. Deleting an account too early can orphan files and automation. Leaving it active after the person departs can expose email, cloud services, remote access and administrative systems.
The Canadian Centre for Cyber Security says onboarding and offboarding should apply least privilege, disable accounts when they are no longer required and include periodic manager review. Its account-lifecycle guidance was written for volunteer organizations, but the control applies equally to employees and contractors.
Assign one departure owner and one deadline
HR, the manager, IT and security each hold part of the information. Name one person who owns completion and set the revocation time against the person’s last authorized working minute.
A routine resignation may allow a scheduled cutover at the end of the final day. An involuntary or high-risk separation may require HR, physical security and IT to act together while the meeting occurs. The timing should come from policy and a risk decision, not an improvised message in a group chat.
Include employees, contractors, temporary workers, interns, volunteers and vendor staff. A contract ending quietly can leave the same access as a formal termination.
Inventory the access before disabling anything
Start with the identity provider and human-resources record, then check systems that may sit outside single sign-on.
- email, calendar and collaboration accounts;
- VPN, remote desktop, Wi-Fi and device-management access;
- cloud consoles, hosting, source code and deployment systems;
- customer relationship, finance, payroll and support applications;
- password managers and shared vaults;
- API tokens, SSH keys, certificates and service credentials;
- social-media, advertising, domain and app-store accounts;
- physical badges, keys, phones, laptops and removable media;
- accounts held directly with suppliers or clients.
Ask the manager what the person actually used. Automated discovery can help, but expense records, browser-managed applications and team knowledge often reveal tools that were never connected to central identity.
Transfer ownership before closing the account
Move business records to a named owner. That can include documents, shared drives, email rules, calendars, dashboards, code repositories, automation, encryption keys, recurring reports and vendor relationships.
Do not give the manager the departing worker’s password or keep the account alive for convenience. Use administrative transfer features, delegation and documented retention. Preserve legal holds and privacy obligations before deleting data.
Redirect business contacts deliberately. An automatic reply or mailbox delegation should have an owner and expiry date. Indefinite forwarding can turn one former account into a permanent information leak.
Disable sign-in, then terminate active access
At the approved time, block interactive sign-in at the central identity provider. Then revoke active sessions, refresh tokens, remembered devices and application passwords. A password reset alone may not end an existing session.
Remove group memberships, privileged roles and delegated access. The Cyber Centre’s administrative-privilege guidance recommends unique identifiable accounts, logging of privileged actions and removal of special access when it is no longer needed.
Rotate shared secrets the person knew. That includes passwords, recovery codes, API keys, private keys and supplier portal credentials. Removing a name from a shared vault does not make a memorized secret invalid.
Close the routes that bypass central identity
Many offboarding failures live outside the main directory. Check local administrator accounts, cloud root users, database logins, network appliances, backup consoles and third-party SaaS accounts.
Review scheduled tasks, automation accounts and integration tokens created or maintained by the departing worker. Transfer them to a service identity with a named owner. Do not simply disable a personal account and discover later that it ran payroll exports or backups.
Mapletechie’s guide to finding internet-exposed administration consoles is useful here: a forgotten remote-management page can preserve access even after the main account is gone.
Collect and verify company assets
Record the serial number and condition of each returned device. Confirm that phones and laptops remain enrolled in device management until company data is secured. For approved bring-your-own-device arrangements, remove the work profile or perform a selective wipe rather than erasing personal data.
Collect access cards, physical keys, hardware security keys, smart cards and removable storage. Disable a missing credential instead of waiting for it to appear.
A Shared Services Canada audit noted that hybrid work makes the return of equipment and access cards harder to coordinate. The answer is a tracked exception with an owner and due date, not an unfinished checklist.
Verify the closure and keep evidence
After the change, attempt a controlled sign-in check or use identity logs to confirm the account cannot authenticate. Search for active tokens, privileged roles and successful logins after the revocation time. Review remote-access and cloud audit logs for unusual activity before and during the departure window.
Keep a record containing the person, effective time, systems checked, action taken, operator, verification result and outstanding exceptions. Avoid storing passwords or unnecessary personal information in the ticket.
The Cyber Centre warns that insider threats can involve people who have or had access to systems and data. Its insider-threat guidance recommends revoking account access and administrative privileges when they are no longer required, monitoring endpoints and checking audit logs during an incident.
Why the checklist needs technical depth
A recent US criminal case shows the damage that privileged access can enable. The US Department of Justice said a former infrastructure engineer scheduled tasks that deleted administrator accounts, changed passwords and shut down servers, then demanded 20 bitcoin. He was sentenced on September 28, 2026.
The case does not establish that offboarding alone would have prevented every action; the conduct began while the person worked at the company. It does show why organizations should minimize standing privilege, monitor administrative actions and avoid letting one identity control accounts, backups and recovery.
Finish the departure only when every access route is closed or recorded as an owned exception. “Account disabled” is one line in the checklist, not the checklist itself.
Tags: employee offboarding, access control, identity management, insider threat, Canada