Topic starter
11/06/2026 10:54 pm
TL;DR: Incomplete SaaS offboarding leaves orphaned licenses, lingering access, and compliance exposure, with 38% of employees admitting they have accessed a prior employer’s accounts after leaving and manual deprovisioning still taking about eight hours per leaver, according to 1Password and Ponemon Institute research. The control gap is not just identity revocation but lifecycle closure across apps, licenses, data transfer, and audit evidence.
Editorial analysis by NHI Mgmt Group, based on content published by 1Password: “The hidden offboarding step draining your budget”.
By the numbers:
- 38% of employees have accessed a prior employer’s accounts after leaving the company.
- 500 employees, with a 15% annual turnover rate = 75 leavers per year.
Key questions
Q: What breaks when SaaS offboarding only removes SSO access?
A: Partial offboarding leaves residual risk because application-level permissions, active sessions, and data custody may still persist.
Q: Why do incomplete leaver processes create both security and finance risk?
A: Because the same orphaned account can keep exposing data while also consuming an unused licence.
Q: How do security teams know whether offboarding is actually working?
A: Security teams should measure completion, not process start.
Practitioner guidance
- Define offboarding as full lifecycle closure Require account deletion, licence reclamation, data transfer, and audit evidence in the same leaver workflow rather than treating revocation as completion.
- Build a continuous SaaS discovery feed Reconcile approved applications, shadow IT, OAuth grants, and business-system integrations so offboarding can see the full estate before turnover happens.
- Separate access revocation from licence recovery Track whether each downstream app removes the account, returns the seat, or only blocks login, and close the gap where the licence remains billable.
Bottom line: Incomplete SaaS offboarding leaves organisations with active access paths, orphaned licences, and weak audit evidence after employees depart.
Explore further
View Full Forum → | NHI Foundation Course → | Our Services → | Read the full analysis →
This topic was modified 1 day ago by NHI Mgmt Group
12/06/2026 7:20 am
Incomplete offboarding is a lifecycle failure, not an access failure. Revocation alone only proves that one access path was removed. If licences, data handoff, and downstream app state are still unresolved, the identity has not actually been retired. Practitioner teams need to think in terms of closure, not just deprovisioning.
A few things that frame the scale:
- Only 20% have formal processes for offboarding and revoking API keys, and even fewer have procedures for rotating them, according to the Ultimate Guide to NHIs.
- Around 59% of companies report experiencing a data breach related to poorly managed offboarding processes.
A question worth separating out:
Q: What is the difference between access revocation and lifecycle offboarding?
A: Access revocation removes the ability to sign in, while lifecycle offboarding closes the account, reclaims the licence, and transfers the business assets tied to that identity. In SaaS environments, the second control is the one that actually ends exposure and waste.
👉 Read our full editorial: SaaS offboarding gaps are driving wasted spend and access risk
This post was modified 1 day ago by NHI Mgmt Group