Topic starter
12/06/2026 1:11 am
TL;DR: Remote offboarding can leave former employees with lingering SaaS, CRM, email, and SSO access, creating avoidable exposure when deprovisioning is delayed or incomplete, according to Zluri and OneLogin. The governance gap is not the exit process itself but the failure to terminate access quickly enough across every identity system.
Editorial analysis by NHI Mgmt Group, based on content published by Zluri: “Employee Offboarding: 5 Security Guidelines for a Remote Workplace”.
By the numbers:
- 32% of companies reported taking more than a week to deprovision employees from SaaS apps who have left.
Key questions
Q: What happens when user deprovisioning is not connected to employee offboarding?
A: When offboarding is disconnected from deprovisioning, former employees can retain access to databases, applications, or shared tools long after they should lose it.
Q: Why do delayed offboarding processes create security risk?
A: Delayed offboarding creates security risk because access can remain active after the business relationship ends.
Q: What signs show that leaver access removal is failing?
A: Common signs include former employees still appearing in SaaS audit logs, licenses remaining assigned after exit, shared passwords not being changed, and IT being unaware of all apps the person used.
Practitioner guidance
- Synchronise leaver workflows Make HR exit, IT deprovisioning, app owner confirmation, and data transfer run as one coordinated process so access removal is not delayed by handoffs.
- Inventory every SaaS application used by each employee Use user-level app discovery so offboarding can include unsanctioned or shadow applications, not just the systems already in the directory.
- Reset shared credentials before account closure Change passwords and reassign ownership for shared accounts, mailboxes, and voicemail systems before the former employee’s access path is considered closed.
Bottom line: Remote offboarding becomes a security problem when identity removal, application ownership, and data handover do not happen together.
Explore further
View Full Forum → | NHI Foundation Course → | Our Services → | Read the full analysis →
This topic was modified 4 days ago by NHI Mgmt Group
12/06/2026 10:55 am
Offboarding is a lifecycle control, not an HR formality: The article shows that access removal is only secure when identity, application, and data handover are terminated together. When those steps are split across teams and time, the organisation creates a residual access window that outlives the employment relationship. For IAM and IGA teams, the lesson is that leaver governance is a control system, not a checklist.
A few things that frame the scale:
- Only 20% have formal processes for offboarding and revoking API keys, and even fewer have procedures for rotating them, according to the Ultimate Guide to NHIs.
- Around 59% of companies report experiencing a data breach related to poorly managed offboarding processes.
A question worth separating out:
Q: How should IAM and SaaS teams share responsibility for app offboarding?
A: IAM should own the lifecycle logic for access removal, while SaaS operations should supply the usage and contract context that proves whether access is still needed. When those functions stay separate, offboarding becomes inconsistent and accounts survive because no single team sees the full picture.
👉 Read our full editorial: Remote employee offboarding exposes the real SaaS access gap
This post was modified 4 days ago by NHI Mgmt Group