Topic starter
05/07/2026 10:45 pm
TL;DR: Leaving former employee accounts active creates a compounded risk of unauthorised access, data exfiltration, compliance failures, and wasted licence spend, according to Josys. The control gap is not awareness but execution: offboarding has to revoke access across IdP, SaaS, API keys, and devices before the account remains usable.
Editorial analysis by NHI Mgmt Group, based on content published by Josys: “How to Delete Offboarding Employee Accounts”.
By the numbers:
- The average company uses more than 100 SaaS applications, so dozens of accounts per departing employee may need deletion.
Key questions
Q: What breaks when ex-employee accounts are not deleted promptly?
A: Delayed deletion leaves former employees able to authenticate after departure, which can enable data exfiltration, unauthorized access, audit findings, and avoidable licence costs.
Q: Why do ex-employee accounts create both security and compliance risk?
A: Active departed-user accounts can be used to reach confidential data and also fail access-removal obligations in GDPR, ISO 27001, SOC 2, and similar frameworks.
Q: How do security teams know whether offboarding is actually working?
A: Security teams should measure completion, not process start.
Practitioner guidance
- Map every departing employee to a full access inventory Build the offboarding list from the IdP, SaaS catalogue, device estate, VPN, and any department-owned tools so hidden accounts do not survive the departure event.
- Revoke access at the departure date, not after Deactivate the primary directory account, disable application logins, revoke remote access, and invalidate personal tokens at end of business on the departure date.
- Treat API keys and tokens as offboarding items Add personally issued API keys, developer tokens, and admin credentials to the same revocation workflow used for human accounts so non-human access does not persist.
Bottom line: Leaving a former employee account active creates a real post-departure access path that can be used for unauthorised access or data theft.
Explore further
View Full Forum → | NHI Foundation Course → | Our Services → | Read the full analysis →
05/07/2026 10:48 pm
Account persistence is the offboarding failure that matters most: once an employee leaves, any remaining live account becomes a governance defect, not a convenience. The security issue is not only unauthorised use, but the fact that the organisation has lost control of where that identity still exists. Practitioners should treat deletion completeness as the core offboarding measure.
A few things that frame the scale:
- Only 20% have formal processes for offboarding and revoking API keys, and even fewer have procedures for rotating them, according to the Ultimate Guide to NHIs.
- 92% of organisations expose NHIs to third parties, raising concerns about supply chain security, according to the Ultimate Guide to NHIs.
A question worth separating out:
Q: Should organisations automate ex-employee account deletion or keep it manual?
A: Automation is preferable when the estate includes many SaaS tools, because manual cleanup is where delays and misses accumulate. The objective is not to remove human oversight, but to remove the dependency on memory and ad hoc follow-up for every departure. Manual review still has a role, but the revocation workflow should be triggered automatically.
👉 Read our full editorial: Ex-employee account deletion is the core offboarding control