Employee offboarding: why access outlives the job

Someone left in March. Their identity provider account was disabled on their last day, as the checklist says. In June, an access review finds their CRM login still works. The CRM had a local account created before single sign-on was set up, and disabling the identity provider never touched it.

Offboarding is the last stage of the employee lifecycle. It’s the stage where a gap is a security incident rather than an inconvenience.

What is the employee offboarding process?

The employee offboarding process removes a leaver’s access to every system on their last day, hands their work over, recovers their equipment and records each step. It starts when the leave date is entered in the HRIS. It moves faster for an immediate or hostile departure.

Where access outlives the employee

1. Disabling single sign-on is treated as done. Local accounts, API keys, personal access tokens and integrations the person set up all survive it.
2. Accounts are disabled before work is transferred. Files, shared calendars, workflow ownership and open records become unreachable the moment the account goes.
3. The revoke call is trusted. A removal that failed looks the same as one that worked, and nobody checks.
4. Every departure runs on the same schedule. A hostile departure needs access gone in minutes, not at midnight.
5. Contractors aren’t in the HRIS. Their end dates live in a spreadsheet, so nothing triggers their offboarding.
6. Equipment is chased by email. Laptops come back late or not at all, with company data on them.

What it costs

Every leaver with live access is a way into the company’s systems that nobody is watching. Auditors ask for a list of people who left and still hold access, and the answer should be zero.

It also costs licenses. Seats stay assigned to people who left, and the company keeps paying for them.

What to fix first

1. Trigger from the HRIS leave date. Offboarding starts when HR records the departure, not when someone files a ticket.
2. Transfer before you disable. Move files, calendars, workflow ownership and open records to the manager first.
3. Remove access in every system. Include apps outside single sign-on, local accounts, API keys and tokens.
4. Check that every removal worked. Read back each system after the removal and flag anything that didn’t change.
5. Keep a fast path for immediate departures. Revoke within minutes, with a person approving the trigger.
6. Report leavers who still hold access. Weekly, to the IT and security owners, until the number is zero.

The guide to building employee offboarding deprovisioning has the prompts for each step.

What it looks like at Auctane

“We have automated so much of the onboarding and offboarding process that we're no longer spending valuable time on manual data entry. We even trigger several other automations around those processes, such as archiving users after a period of time or suspending inactive users. With Tray, we're not only saving time, but we're reducing risks.”

Where it fits

Offboarding reverses everything onboarding granted and every role change added, so it’s only as complete as the record of what was granted. Freed licenses feed software license optimization.

For all eight stages, see the hire-to-retire process.