Topic starter
25/10/2026 11:10 am
TL;DR: Only 20% of organisations have formal offboarding and API-key revocation processes, a gap Hexnode links to missed access, broken operations, and lost evidence. Off-boarding needs verified identity, approved timing, full access and device inventory, and documented exceptions before any action starts.
Editorial analysis by NHI Mgmt Group, based on content published by Hexnode: “What should IT verify before starting an employee offboarding workflow?”.
Key questions
Q: Why do SSO-based offboarding processes sometimes leave access behind?
A: SSO revocation removes one authentication path, but it does not always terminate existing SaaS sessions or remove app-specific entitlements.
Q: What are the signs that employee offboarding is failing in practice?
A: Common warning signs include still-active sessions after termination, lingering logins on SaaS platforms, missed shared credentials, and unexpected file downloads or configuration changes.
Q: What breaks when offboarding is not tied to the source identity record?
A: When offboarding is disconnected from the source identity record, access can remain active in downstream systems even after employment ends.
Practitioner guidance
- Verify the employee record before any action Match the offboarding request to a unique employee or contractor record, then resolve conflicts in name, department, location, username, or duplicate directory entries before proceeding.
- Lock in the approved timing and authority Record the exact effective date, time, time zone, and approving authority so the revocation sequence follows the authorised departure plan rather than an informal message or meeting invite.
- Inventory every downstream access path Start with the primary directory, then enumerate SaaS applications, cloud consoles, privileged access, shared accounts, vendor portals, and any locally managed accounts tied to the departing employee.
Bottom line: The biggest offboarding risk is not the final revocation step, but the incomplete preparation that leads to missed access, broken operations, or lost evidence.
Glossary terms: Off-boarding, Residual Access, Ownership Transfer, Leaver workflow
Explore further
View Full Forum → | NHI Foundation Course → | Our Services → | Read the full analysis →
This topic was modified 7 days ago by NHI Mgmt Group
27/10/2026 7:18 pm
Offboarding is an identity governance control, not an administrative afterthought. The article is right to place verification before deactivation because offboarding is where identity truth gets tested against HR records, device state, and downstream access paths. When that sequence is wrong, the organisation is not just slow, it is operating on an unverified identity graph. Practitioners should treat leaver handling as a governed lifecycle event, not a ticket to close.
A few things that frame the scale:
- Only 20% have formal processes for offboarding and revoking API keys, and even fewer have procedures for rotating them, according to the Ultimate Guide to NHIs.
A question worth separating out:
Q: How should organisations handle evidence and legal holds during employee offboarding?
A: They should separate access removal from preservation decisions. If litigation hold, investigation, privacy, or retention rules apply, those constraints must be documented before execution, with a named owner, justification, and expiry condition so the exit does not destroy required evidence or create compliance gaps.
👉 Read our full editorial: Offboarding errors start before account revocation begins
This post was modified 7 days ago by NHI Mgmt Group