What do teams get wrong about deactivating users and revoking access when employees leave?

A common mistake is treating offboarding as an administrative afterthought rather than a controlled security event. If deactivation is delayed or handled inconsistently, accounts can remain active longer than intended and permissions can linger across systems. Strong offboarding requires workflow, ownership, and automated removal of access tied to authoritative identity records.

Why offboarding is a security control, not just an HR task

Leaving employees should trigger a controlled access change, not a manual clean-up. The security mistake is assuming one action, such as disabling an email login, is enough. In practice, access often exists across SaaS apps, admin consoles, shared workspaces, VPNs, APIs, and delegated tools, so the real job is to remove the person’s effective authority everywhere it was granted.

Offboarding works best when teams treat the departure event as an identity lifecycle milestone. That means authoritative records drive the workflow, not ad hoc tickets or memory. When joiner-mover-leaver processes are weak, access removal becomes inconsistent, and the organisation keeps relying on stale entitlements long after the employment relationship has ended. See IAM and IGA Basics for the broader control model behind provisioning and deprovisioning.

Timing matters because access risk is front-loaded. The longer an account remains active after departure, the longer it can be used by the former employee, an insider collaborator, or anyone who obtains the credentials. That is why offboarding is strongest when deactivation, entitlement removal, and token or secret revocation are coordinated as one workflow rather than treated as separate housekeeping tasks.

What teams miss when they think deactivation alone is enough

One common error is disabling the primary login while leaving secondary paths open. A user may still have active sessions, app-specific tokens, API keys, SSH keys, group memberships, or delegated access in downstream systems. If those paths are not revoked, the account is technically inactive but still operationally useful to an attacker or former insider.

Another mistake is overlooking ownership and exception handling. Access rarely disappears automatically just because someone left the company. Shared mailboxes, team drives, code repositories, alerting tools, and privileged support functions often need explicit reassignment or closure. Access review and certification processes help close that gap, especially when they force someone to confirm that each entitlement should be removed, transferred, or retained for a documented reason. Access Reviews and Certification Guide is the right reference point when the challenge is not just removal, but verifying that nothing material was missed.

Offboarding also fails when teams do not map the person to all the identities they used. The employee account is only one layer. Contractors, break-glass access, service proxies, and machine-facing credentials may be tied to the same operator or workflow. Where the departure affects non-human access paths too, lifecycle visibility becomes critical, and the underlying inventory must be accurate before revocation can be trusted. NHI Lifecycle Management Guide explains why lifecycle control depends on discovery, ownership, and deprovisioning together.

How to make revocation complete and reliable

The practical control objective is simple: remove access at the source, then confirm it is gone in the systems that matter. That requires a workflow tied to authoritative identity records, a clear owner for each entitlement domain, and automation that can revoke access consistently across applications, cloud services, and privileged paths. Without that structure, teams end up with partial deactivation that looks good in a ticket but leaves real exposure behind.

Good offboarding also needs a review of long-lived secrets and standing credentials. If a departing employee could still authenticate through cached tokens, stored keys, or shared credentials, the account closure is incomplete. Secret rotation or credential revocation should happen where the credential itself carries access, especially for service integrations and operational tooling. The Guide to the Secret Sprawl Challenge is useful when the risk is credential persistence rather than a simple user login.

At scale, the control question changes from “Did we disable the account?” to “Did we remove every path that still authenticates or authorises this person’s old authority?” That is why organisations with many apps or many privileged users need strong lifecycle governance, not just helpdesk execution. If access removal depends on manual follow-up, the process will eventually miss something. The strongest pattern is automated deprovisioning plus targeted human review for exceptions, high-risk roles, and shared or privileged access.

Risk and Threat Considerations

Delayed or incomplete offboarding creates a direct exposure window for account misuse, privilege retention, and unauthorised access after employment ends. The risk is not limited to the original user account, because stale entitlements, active sessions, and unrevoked secrets can preserve access even when the main login is disabled.

Failure mechanism: Access remains live in one or more systems because deactivation is not synchronised across identity records, applications, and secrets or token stores. That leaves a former employee, or anyone who obtains the old access path, able to act with valid authority.

Impact: The organisation can face data loss, unauthorised changes, fraud, persistence by an insider or attacker, and delayed detection because the access still appears legitimate in downstream systems.

Standards & Framework Alignment

This section maps relevant standards and security frameworks to the operational risks and controls described in this guidance.

OWASP Non-Human Identity Top 10 addresses the attack surface, NIST SP 800-53 Rev 5 and CIS Controls v8 set the technical controls, and ISO/IEC 27001:2022 defines the regulatory obligations.

Framework	Control / Reference	Relevance
OWASP Non-Human Identity Top 10	NHI-01 — Improper Offboarding	Employee exits can leave NHI credentials and access paths active.
	NHI-07 — Long-Lived Secrets	Departures often expose lingering tokens, keys, and other persistent secrets.
Recommendation — Revoke all non-human credentials and entitlements when the owner leaves. Rotate or retire long-lived secrets tied to departed staff immediately.
NIST SP 800-53 Rev 5	PS-4 — Personnel Termination	Directly addresses terminating system access when employment ends.
	IA-5 — Authenticator Management	Offboarding must revoke or rotate authenticators, tokens, and related material.
	AC-2 — Account Management	Offboarding depends on account disablement, removal, and review of lingering access.
Recommendation — Disable accounts and remove access as part of termination processing. Invalidate authenticators and secrets that could still grant access. Use account lifecycle controls to remove access from departed users.
ISO/IEC 27001:2022	A.5.18 — Access rights	Access rights must be removed or adjusted when employment changes end.
Recommendation — Review and revoke access rights promptly at termination.
CIS Controls v8	CIS-6 — Access Control Management	Access control management covers timely removal of access at offboarding.
Recommendation — Automate removal of access and verify it across all systems.

Practitioner Guidance

What to verify: Confirm that the offboarding workflow removes the person from the authoritative identity source, disables active sessions where possible, and revokes application, cloud, and privileged entitlements that were not part of the primary login. If any system still shows the departed user as authorised, treat the offboarding as incomplete.

Decision rule: If the departing employee had privileged access, shared access, or any credential that can authenticate outside the main SSO path, prioritise credential rotation and entitlement review before closing the case. A clean ticket is not enough evidence that access is gone.

Practitioner takeaway: The real measure of offboarding is not whether the account is disabled, but whether every surviving path to the person’s former authority has been removed, reassigned, or explicitly justified.