How should teams manage WiFi access when employees join or leave the organisation?

Why WiFi Access Should Follow the Employee Lifecycle

WiFi access is easiest to manage when it behaves like any other workplace access control: tied to a named user, granted from a central source, and removed when the person leaves. That avoids the operational drift that comes with shared passwords, where nobody can reliably tell who has access, who used it last, or whether old credentials are still circulating.

The practical benefit is consistency. Joiners can be onboarded without waiting for manual network changes, and leavers can be disabled at the same point their other accounts are revoked. That makes WiFi part of the normal identity lifecycle rather than a separate exception that security and IT teams must remember to clean up.

It also improves accountability. If access is assigned to individuals, teams can review who can connect, trace access decisions back to employment status, and align network access with role-based need instead of convenience or habit.

What Good WiFi Access Management Looks Like in Practice

Good practice is to connect WiFi authorization to the organisation’s central identity source, so the network accepts the same lifecycle events that drive onboarding and offboarding elsewhere. In many environments this is done through corporate directory services or wireless authentication backed by centralized access policy, not by handing out a password that outlives the employee.

That design matters because the access decision should change automatically when the person’s status changes. A new employee should inherit access once their account is active and their role is approved. A departing employee should lose access as soon as offboarding starts, without waiting for someone to remember the WiFi credential as a separate task.

Where possible, use individual authentication rather than a shared network secret. NIST SP 800-53 Rev 5 Security and Privacy Controls is useful here because it ties access control and identification and authentication to the broader control environment. For organisations that want a more operational checklist, CIS Controls v8 reinforces account management and access control as everyday safeguards rather than one-off admin tasks.

How to Avoid Shared Password Drift and Offboarding Gaps

The biggest failure mode is treating WiFi as an exception to normal identity governance. Shared passwords spread quickly, get reused across teams, and often remain valid long after the employee who first received them has left. Once that happens, revocation becomes uncertain because the organisation no longer has a clean list of who possesses the secret.

For that reason, WiFi access should be removed by disabling the user’s access path, not by asking people to “remember to stop using it.” If the same access model is used for employees, contractors, and guests, then the policy needs clear separation so that each population can be turned off cleanly when their status changes.

ISO/IEC 27001:2022 Information Security Management supports this kind of lifecycle control because it links access governance to formal policy and operating discipline. For organisations that want to see how access restrictions are treated in a broader compliance context, EU NIS2 Directive also reinforces the need for controlled access and operational resilience around core systems.

Practitioner Guidance

What to prioritise: Put WiFi into the same joiner, mover, leaver process as email, VPN, and application access. If wireless access is managed differently, it will almost always lag behind offboarding and create residual access risk.

What to verify: Confirm that a leaver’s wireless access is actually tied to a revocation event from the central identity source, not a manual checklist item. Also verify that any shared guest or fallback network is segregated from employee access and has a separate expiry process.

Common mistake: Keeping one shared WiFi password for convenience while assuming offboarding is still effective. That approach makes revocation partial at best, because former staff, contractors, and copied credentials can all keep working until the password is rotated.

Practitioner takeaway: The strongest WiFi control is the one you do not have to remember to clean up, access should start from identity, end from identity, and never depend on informal password handling.

Related resources from NHI Mgmt Group

• Why does SAML reduce operational risk when employees join, move teams, or leave an organisation?
• How should federal teams manage identity access when employees change roles or locations?
• How should security teams manage SaaS access when employees use both managed and unmanaged apps?
• How should organisations manage shared access to social media accounts without losing control when employees or agencies leave?