Employee offboarding is now an identity governance problem

At a glance

What this is: A governance analysis of employee offboarding that shows why revoking access, transferring ownership and clearing device data has become a multi-system identity problem.

Why it matters: IAM, IGA and PAM teams need to treat offboarding as an access-lifecycle control across SaaS, shared credentials, OAuth links and endpoint data, not as a simple account deletion task.

Context

Employee offboarding is no longer a single account-closure task. In distributed workplaces, data, shared credentials and SaaS entitlements are spread across sanctioned and unsanctioned services, so the real governance problem is proving that access, ownership and exposed data were removed everywhere they existed.

The article frames this as an identity governance issue because the leaver can retain access through shared passwords, OAuth-connected accounts, copied files and unmanaged devices even after the primary account is deleted. That makes offboarding a lifecycle control problem across human identity, application access and shadow SaaS use.

The source's core message is practical rather than theoretical: incomplete offboarding leaves organisations exposed to security, privacy, compliance and licence-spend risk, and manual checklist processes are too brittle for that environment.

Key questions

Q: What breaks when employee offboarding is handled as a simple account deletion?

A: Account deletion alone leaves residual access paths in SaaS apps, shared passwords, OAuth grants, owned files and personal device copies. The result is that a former employee may still reach data or workflows even though the directory account is gone. Effective offboarding must terminate every access path, not just the primary login.

Q: When should organisations prioritise access revocation over account deletion in offboarding?

A: Access revocation should come first whenever the departing person can still reach SaaS applications, shared credentials or delegated OAuth access. Account deletion is only safe after the organisation has confirmed that no alternate path to company data remains. In distributed environments, the revocation step is the real control, and directory closure is only one part of it.

Q: What are the signs that employee offboarding is failing in practice?

A: Common warning signs include still-active sessions after termination, lingering logins on SaaS platforms, missed shared credentials, and unexpected file downloads or configuration changes. Another red flag is incomplete device recovery or gaps in the audit trail. If alerts show login attempts from deactivated accounts, the offboarding process likely missed a revocation step or took too long.

Q: Who is accountable when offboarding leaves SaaS access active?

A: Accountability sits with the identity, security, and application owners who define the workflow and the revocation path. If a departing user still has access, the failure is usually a governance one: no enforced owner, no tested deprovisioning path, or no closure on outstanding entitlements.

Technical breakdown

Why SaaS sprawl breaks offboarding workflows

Offboarding fails when identity data is scattered across SaaS applications that IT does not fully inventory. In that model, deleting the employee directory account does not terminate the separate application entitlements, OAuth grants or externally shared resources that keep the person connected to corporate data. The control problem is discovery first, revocation second: if you do not know where the identity is represented, you cannot remove it. Distributed work also increases the chance that app access was self-provisioned outside central governance, which turns offboarding into a search-and-remediate exercise rather than a single workflow.

Practical implication: build offboarding around SaaS discovery and entitlement inventory before you automate termination steps.

Why shared passwords and OAuth links outlive the user account

A departing employee may not be the only holder of access. Teams often reuse shared passwords across tools, and those credentials stay valid until someone changes them manually. In parallel, some applications remain reachable through OAuth relationships even after the user's primary password changes, because the token or delegated grant is separate from the login credential. That distinction matters: account deletion does not necessarily revoke the delegated trust path. Identity governance has to treat shared secrets and third-party authorisations as distinct objects with their own lifecycle, not as side effects of the user account.

Practical implication: revoke delegated OAuth access and rotate shared credentials as separate offboarding tasks, not as a single account action.

Why device wiping and ownership transfer are part of identity governance

Offboarding does not end at access removal. Company files, calendars, meetings and local caches can remain on personal or corporate devices, and those assets often carry ongoing business value after the person leaves. At the same time, deletion without ownership transfer can remove operational context that teams still need, such as calendar continuity, document stewardship and customer communication trails. In governance terms, offboarding is a lifecycle transition for data, not just a privilege event. The organisation must separate corporate content from personal content, preserve required records and assign ownership to an accountable successor.

Practical implication: treat data ownership transfer and selective remote wipe as mandatory offboarding controls, not clean-up chores.

Threat narrative

Attacker objective: The attacker or former insider wants continued access to company data, business tools and collaboration context after the employment relationship has ended.

1. Entry occurs through a valid employee, contractor or collaborator identity that has already been granted access to multiple SaaS applications and shared credentials.
2. Credential or access persistence follows when passwords are reused, OAuth grants remain active, or application access is never explicitly revoked after departure.
3. Impact appears as data theft, compliance exposure, productivity loss or continued licence cost because the offboarded identity still influences corporate systems after exit.

Breaches seen in the wild

• Coupang Signing Key Breach: Unrevoked signing key credentials expose 33.7 million records after employee offboarding failure at Coupang.
• Ledger Connect Kit npm compromise 2023: Attackers phished a former Ledger employee with unrevoked npm access and published a wallet-draining Connect Kit, stealing about $600k on 14 Dec 2023.

Read and download The State of NHI & AI Agent Breach Report 2026, covering 200+ breaches impacting Non-Human Identities including AI Agents.

NHI Mgmt Group analysis

Employee offboarding is now an access-lifecycle problem, not a deletion task. The article reflects a broader governance reality: account removal does not equal access termination when identities are replicated across SaaS, shared secrets and delegated authorisations. The practical consequence is that IAM and IGA teams must measure offboarding by residual access eliminated, not by tickets closed.

Shared credentials create offboarding blind spots that basic user lifecycle models miss. When departments reuse the same password across tools, a leaver can remain functionally present even after formal offboarding. That exposes a weakness in lifecycle governance assumptions, because the control boundary is the credential set, not the person record. The implication is that lifecycle processes must track shared secret ownership explicitly.

OAuth-linked access turns third-party authorisation into a lifecycle dependency. The article correctly flags that some applications stay reachable after password changes because delegated access survives separately. That means offboarding controls need a concept of downstream trust relationships, not just account disablement. For practitioners, the governance unit is the grant, the token and the app relationship, not only the directory account.

Offboarding quality is now a compliance and cost-control signal, not just an HR hygiene metric. The article ties incomplete offboarding to licence waste, privacy exposure and audit risk. That combination matters because it shows offboarding sits at the intersection of identity governance, spend management and evidence production. Practitioners should treat failed offboarding as a measurable control defect with business impact, not an administrative inconvenience.

From our research library:

• Only 20% have formal processes for offboarding and revoking API keys, and even fewer have procedures for rotating them, according to the Ultimate Guide to NHIs.
• Read next: NHI Lifecycle Management Guide

What this signals

Residual access is the real offboarding risk: identity governance breaks down when users can still reach SaaS apps through shared credentials, OAuth grants or unsynchronised application accounts after the HR event is complete. That is why offboarding needs revocation evidence, not just termination status.

Offboarding programmes should be measured by how quickly they eliminate alternate access paths and how consistently they transfer ownership of business-critical data. A fast checklist is not enough if it leaves behind token grants, local device copies or unowned shared resources.

For practitioners

• Map every offboarding path to application-level entitlements Create a revocation inventory that includes SaaS accounts, federated logins, shared credentials, OAuth grants and externally managed apps before the leaver date.
• Separate shared-secret rotation from account disablement Require password changes for any team-used credential set and verify that the old secret is no longer accepted in downstream tools.
• Add OAuth grant revocation to the offboarding checklist Treat delegated authorisations as independent objects and confirm that token-based access is removed even when the primary password has already changed.
• Transfer ownership before deleting the departing account Reassign calendars, files, recurring meetings and automation assets to an accountable manager so business continuity is preserved without leaving residual access behind.
• Automate device clean-up with data scoping controls Use remote wipe and endpoint workflows that remove only corporate data from managed and personal devices while preserving personal content and required records.

Key takeaways

• Employee offboarding is a lifecycle control for access, data and ownership, not a simple account-deletion exercise.
• The article shows that access can persist through shared passwords, OAuth links and unmanaged SaaS accounts even after departure.
• Practitioners need revocation evidence, ownership transfer and selective device cleanup to prevent residual risk and wasted licences.

Key terms

• Offboarding: Offboarding is the controlled retirement of a workload, service account, token, certificate, or other non-human identity when it is no longer needed. It includes revoking credentials, removing permissions, and verifying that no residual trust path remains available to attackers.
• Delegated Access: Delegated access is permission granted to one identity to act on behalf of another user, service, or system. In NHI environments, this usually appears in OAuth-connected apps and automation tooling. It is powerful, but it must be tightly scoped and reviewed because it can persist long after the original business need ends.
• Shared credentials: Shared credentials are passwords, tokens, or access secrets used by more than one person or system. They weaken attribution and revocation because no single identity owns the secret cleanly, which increases blast radius when the credential is exposed or abused.
• Ownership Transfer: Ownership transfer is the point at which an extension changes hands, either through sale, account compromise, or developer handoff. It matters because the extension can keep the same name, rating, and install base while becoming a materially different security object after the transfer.

Deepen your knowledge

NHI governance, agentic AI identity, and machine identity lifecycle are core topics in our NHI Foundation Level course, the industry's only accredited NHI security programme. If you are responsible for identity security strategy or NHI governance in your organisation, it is worth exploring.