Employee offboarding is now an identity governance problem

At a glance

What this is: This is an analysis of why employee offboarding has become an identity governance problem, with emphasis on SaaS access, shared passwords, device data and auditability.

Why it matters: It matters because offboarding now touches human IAM, third-party access, and NHI-style credentials such as shared passwords and OAuth connections, so incomplete lifecycle controls can leave former users with operational access long after departure.

By the numbers:

• The average number of years an employee is spending on a job is constantly getting reduced, from 4.6 years in January 2012 to 4.1 years in January 2020, a decline of more than 10% according to the U.S. Bureau of Labor Statistics.

👉 Read Efecte's article on problem-free employee offboarding

Context

Employee offboarding is no longer a simple HR or help desk task. In distributed environments, a departing worker may leave behind access in SaaS apps, shared credentials, device copies of data, and account links that remain active even after the person is gone.

The identity governance issue is lifecycle control across multiple systems, not just disabling a primary account. When revocation, ownership transfer, logging, and data cleanup happen late or inconsistently, the organisation retains residual access paths that can be abused intentionally or exposed accidentally.

Key questions

Q: What breaks when employee offboarding is handled as a simple account deletion?

A: Account deletion alone leaves residual access paths in SaaS apps, shared passwords, OAuth grants, owned files and personal device copies. The result is that a former employee may still reach data or workflows even though the directory account is gone. Effective offboarding must terminate every access path, not just the primary login.

Q: Why do offboarding failures create both security and compliance risk?

A: Security risk comes from lingering access to data and systems after departure. Compliance risk comes from failing to prove what was revoked, retained, or transferred, especially where logs and data handling are required for audit. Offboarding must therefore produce evidence, not only action, if it is to satisfy governance and regulatory expectations.

Q: What do security teams get wrong about SaaS offboarding?

A: They often assume the directory account is the only access object that matters. In practice, SaaS connections, shared credentials and personal device data can survive after the employee leaves. Teams need to map and revoke those secondary access paths with the same discipline they apply to the primary account.

Q: How should organisations reduce residual access after an employee leaves?

A: Use a controlled offboarding workflow that starts with application discovery, continues through access revocation and ownership transfer, and ends with evidence review. The key is to verify that no business system, token, shared password or data copy still grants practical access after departure.

Technical breakdown

Why SaaS discovery is the first offboarding control

Modern offboarding fails when organisations only know about sanctioned applications. Employees often sign up for cloud tools outside IT control, then connect them to work data, email, or file storage. SaaS discovery is the process of identifying those connected services before the leaver leaves, because you cannot revoke access you cannot see. For identity teams, the important point is that lifecycle execution starts with inventory, not with termination. Without a complete map of connected applications, offboarding becomes a partial event that clears only the systems already known to IT.

Practical implication: build offboarding around application discovery and connection visibility, not around a single directory disable action.

Shared passwords and OAuth links create hidden residual access

Shared passwords are often reused across teams, and password changes do not always invalidate the underlying sharing practice. OAuth-connected apps add another layer of persistence because access can survive a password reset unless the linked token or grant is revoked. In lifecycle terms, these are non-human identity controls embedded in human offboarding. The risk is that the departed user is removed from the directory while the effective access path remains alive through a shared secret or delegated app authorization.

Practical implication: treat shared passwords and OAuth grants as separate revocation targets during offboarding.

Why audit logs and ownership transfer matter after departure

Deleting an account without transferring ownership can destroy business records, calendars, files and workflow history that others still need. At the same time, offboarding actions must be logged in a way that proves what was removed, when it was removed, and who approved the action. This is where identity governance and compliance intersect: lifecycle controls must preserve continuity for the business while demonstrating that access and data handling were controlled correctly. Logs are not a nice-to-have; they are the evidence trail for the offboarding decision.

Practical implication: require ownership transfer and auditable offboarding logs before account closure or data cleanup.

Threat narrative

Attacker objective: The objective is to preserve or exploit post-departure access to company data, credentials, and business systems after offboarding should have closed those paths.

1. Entry occurs through a former employee, contractor, or consultant retaining access after the working relationship has ended, often through SaaS accounts, shared passwords, or OAuth-linked approvals.
2. Escalation happens when that residual access reaches finance systems, CRM data, shared drives, or personal device copies that were never fully revoked or removed.
3. Impact follows when confidential data is copied, exposed, misused, or when missing licence and account control creates compliance and operational loss.

Breaches seen in the wild

• Coupang Signing Key Breach — Unrevoked signing key credentials expose 33.7 million records after employee offboarding failure at Coupang.
• MongoBleed breach — MongoBleed exposed secrets across 87K MongoDB servers.

Read our 52 NHI Breaches Analysis report for a comprehensive view of breaches impacting Non-Human Identities including AI Agents.

NHI Mgmt Group analysis

Offboarding is a lifecycle control problem, not a ticket closure problem. The article describes a familiar failure pattern: organisations disable a main account but leave behind connected SaaS grants, shared passwords, and data copies. That is not an execution issue alone. It is a governance failure in how identity removal is defined, evidenced and verified. The practical conclusion is that offboarding must be measured by residual access elimination, not by completion of a checklist.

Shared passwords are a non-human identity risk hidden inside human offboarding. The article correctly flags team-wide passwords and OAuth continuations as gaps that survive departure. Those are not just human account issues, because the effective access path is often the credential, token, or app grant rather than the person. Organisations that still treat offboarding as purely human IAM are missing the NHI layer of the problem. The implication is that identity programmes must revoke secrets and delegated access, not just user records.

Residual access after departure: This failure mode is what happens when access ownership outlives the employee relationship. The article shows that external parties, consultants and freelancers often keep access longer than intended, especially when revocation is manual or inconsistent. That is a lifecycle assumption failure: access is assumed to end with employment or contract end date, but the actual control boundary is much messier. Practitioners should treat termination as the start of verification, not the end of governance.

Automation changes offboarding from a best-effort process into a control system. Manual offboarding cannot reliably keep up with the number of apps, devices and delegated access paths described here. The article's own logic points to a broader operating model shift: lifecycle tasks need orchestration, evidence capture and repeatable execution. For identity teams, the issue is not whether automation is convenient, but whether the programme can prove control over residual access at scale.

Compliance exposure in offboarding is usually an evidence problem before it is a policy problem. The article highlights logs, least privilege, retention, and data handling as the points where offboarding meets audit. That is exactly where many programmes fail, because they can describe process intent but cannot prove what happened in each system. The practical conclusion is that offboarding controls must produce audit-ready evidence by design, or they are not governance controls at all.

From our research:

• 1 in 4 organisations are already investing in dedicated NHI security capabilities, with an additional 60% planning to do so within the next twelve months, according to The State of Non-Human Identity Security.
• 85% of organisations lack full visibility into third-party vendors connected via OAuth apps, with 38% reporting no or low visibility and 47% only partial visibility, according to The State of Non-Human Identity Security.
• That visibility gap is why NHI Lifecycle Management Guide belongs in the offboarding workflow alongside application discovery and revocation evidence.

What this signals

Residual access after departure is becoming the programme-level risk signal. As organisations add more SaaS and contractor access, offboarding has to move from HR handoff to identity operations. Teams should expect more pressure to prove that access, ownership and data exposure were actually closed, not just that a ticket was completed.

With 85% of organisations lacking full visibility into third-party vendors connected via OAuth apps, according to The State of Non-Human Identity Security, the same blind spot will appear in offboarding unless organisations inventory delegated access as aggressively as they disable users. Offboarding programmes that do not account for external connections will keep missing the access paths that matter most.

Lifecycle governance is converging across human identities and machine-style credentials. Organisations that already have NHI Lifecycle Management Guide principles in their programme can apply the same discipline to shared passwords, OAuth grants and service-owned resources when employees leave.

For practitioners

• Inventory every connected SaaS app before offboarding begins Use discovery to identify sanctioned and unsanctioned applications, then tie each to an owner and a revocation path before the departure date.
• Revoke delegated access separately from password resets Treat OAuth grants, app tokens, shared passwords and recovery paths as distinct control objects so a user disable action does not leave usable access behind.
• Transfer ownership of files, calendars and workflows before account closure Move business-critical artefacts to a manager or service account first, then close the leaver account only after continuity is verified.
• Generate offboarding evidence that survives audit review Log who approved the action, which systems were touched, what was removed, and when each revocation completed so the process can be verified later.

Key takeaways

• Offboarding is an identity governance process because residual SaaS access, shared credentials and delegated grants can outlive the employee relationship.
• The evidence gap matters as much as the access gap, because organisations need logs, ownership transfers and revocation records to prove control.
• The practical fix is lifecycle orchestration: discover connected apps, revoke every access path, transfer business assets and retain auditable proof.

Key terms

• Residual Access: Residual access is any remaining path to company systems, data or applications after an identity should have been removed. It includes forgotten SaaS permissions, OAuth grants, shared passwords, device copies and transferred resources that were never fully closed out.
• Offboarding Evidence: Offboarding evidence is the record that shows what access was removed, when it was removed, and who approved or executed the action. It is the proof layer that turns lifecycle activity into governance, especially when audits or investigations need to verify control.
• SaaS Discovery: SaaS discovery is the process of identifying the cloud applications, connections and data-sharing relationships used by employees, including services IT did not explicitly approve. It is essential because lifecycle controls cannot revoke or transfer what the organisation has not mapped.
• Ownership Transfer: Ownership transfer is the handoff of calendars, files, workflows and other business assets from a departing user to an appropriate manager, team or service account. It preserves continuity while preventing accidental data loss when the original account is closed.

What's in the full article

Matrix42's full article covers the operational detail this post intentionally leaves for the source:

• A step-by-step breakdown of offboarding tasks for SaaS accounts, device cleanup and access termination.
• Specific guidance on handling forwarded email, shared passwords and OAuth-based residual access.
• Practical examples of license reassignment and cost control after employee departure.
• A fuller explanation of how automated workflows reduce missed offboarding steps and improve audit readiness.

👉 The full Efecte post covers offboarding automation, compliance logs and license recovery details.

Deepen your knowledge

NHI governance, agentic AI identity, and machine identity lifecycle are core topics in our NHI Foundation Level course, the industry's only accredited NHI security programme. If you are building or maturing an IAM programme, it is worth exploring.