Topic starter
12/06/2026 12:52 am
TL;DR: Employee offboarding is a significant security threat for 76% of executives, and 58% say COVID-19 made offboarding harder, with SSO session persistence and incomplete deprovisioning driving the risk, according to Zluri. That makes offboarding a governance problem across identity, data retention, and application access, not just an HR workflow.
Editorial analysis by NHI Mgmt Group, based on content published by Zluri: “Employee Offboarding for IT & HR: A Data-Backed Case Study”.
By the numbers:
- 58% of executives reported that offboarding processes have changed because of COVID-19 and an enforced remote workforce and have become more challenging.
- Two-thirds, or 67%, of executives believe that employees exiting the organization are more likely to cause security breaches by accident than intentionally.
Key questions
Q: What breaks when offboarding and deprovisioning are not unified?
A: Access removal becomes inconsistent, which means former users, changed roles, or stale accounts may retain access in one system after they have been removed in another.
Q: Why do delayed offboarding processes create security risk?
A: Delayed offboarding creates security risk because access can remain active after the business relationship ends.
Q: What are the signs that offboarding device controls are failing in practice?
A: The warning signs are repeated delays, missing device returns, inconsistent handling of departures, and reliance on people remembering to act.
Practitioner guidance
- Define offboarding completion as verified access removal Track closure across the identity provider, the SaaS application, and any active session state before declaring the employee fully offboarded.
- Inventory applications with independent deprovisioning paths Identify SaaS tools that retain their own entitlements, sessions, or ownership records so they can be handled separately from SSO disablement.
- Separate data transfer from access revocation Require a distinct step for transferring ownership or backing up content before the employee record is fully retired.
Bottom line: Employee offboarding fails when organisations treat SSO deprovisioning as the end of access rather than the start of verification across apps and sessions.
Explore further
View Full Forum → | NHI Foundation Course → | Our Services → | Read the full analysis →
This topic was modified 4 days ago by NHI Mgmt Group
12/06/2026 10:23 am
Offboarding is a lifecycle control problem, not an HR checkbox. The article shows that closing an account does not equal ending authority, because access can survive in sessions, application permissions, and retained data. That means the governance model has to follow the identity across its full exit path, not stop at the directory event. Practitioners should treat offboarding as a state transition that must be verified across systems, not assumed from a single action.
A few things that frame the scale:
- Only 20% have formal processes for offboarding and revoking API keys, and even fewer have procedures for rotating them, according to the Ultimate Guide to NHIs.
- Around 59% of companies report experiencing a data breach related to poorly managed offboarding processes.
A question worth separating out:
Q: How should IAM teams handle data left behind by departing employees?
A: They should make data transfer or backup a required offboarding step, separate from account closure. Departing employees often leave shared files, project artifacts, and application-owned records that must be preserved or reassigned. If the organisation cannot move custody cleanly, offboarding is incomplete even when login access has been removed.
👉 Read our full editorial: Employee offboarding exposes the limits of SSO deprovisioning
This post was modified 4 days ago by NHI Mgmt Group