When should schools recertify or retire unused staff accounts?

When should schools recertify or retire staff access?

Schools should treat staff access as a lifecycle control, not a one-time onboarding task. Recertify or retire accounts when teaching tools are no longer active, when staff move roles, and when applications are replaced. The practical question is whether the account still reflects a current business need, because unused access remains part of the attack surface.

What makes an account due for review or removal?

The strongest trigger is a change in use, not simply a calendar date. If a platform is no longer needed for lessons, administration, or assessment, the account should be reviewed for removal or reduced scope. The same applies when a teacher becomes a coordinator, leaves a department, or no longer needs the same systems.

Schools should also recertify accounts after system changes, such as an LMS replacement, a migrated student records platform, or a new communication tool. Old access often survives because teams focus on the new system and forget the legacy one. That is where dormant accounts turn into hidden dependency risk and unnecessary privilege.

How should schools manage dormant staff accounts over time?

Recertification works best when it is tied to access governance, not emergency cleanup. A good process maintains an inventory of staff accounts, their owning department, and the business reason they exist. When that reason disappears, the account should be disabled, retired, or moved to a controlled archive state rather than left active by default.

The review should cover both directly used staff logins and any accounts that support classroom software, departmental tools, or third-party services. Schools often inherit accounts through procurement or device setup, so the account owner is not always obvious. That is why IAM and IGA Basics matter here: they frame access review as part of normal identity lifecycle governance, including joiner-mover-leaver change and entitlement cleanup.

Where schools run formal review cycles, the goal should be to confirm current need and eliminate stale access before it becomes an audit or incident problem. Access Reviews and Certification Guide is especially relevant because it emphasizes removing access, not just collecting approvals, which is the right model for staff accounts that quietly outlive their purpose.

Risk and Threat Considerations

Unused staff accounts are attractive because they often have valid credentials, familiar naming patterns, and weak monitoring. If an account is never retired, it can become a low-friction entry point for lateral movement, abuse of inherited permissions, or persistence after role change. The risk rises when passwords are reused, MFA is absent, or the account still reaches systems that matter operationally.

Failure mechanism: A dormant account retains authentication paths and access rights after the business need has ended, so compromise can occur long after the original owner stopped using it.

Impact: Attackers may gain unnoticed access to school systems, exposed data, or administrative functions, and defenders may miss the account because it no longer appears active in day-to-day operations.

Practitioner Guidance

What to prioritise: Start with accounts tied to high-value systems, shared classroom tools, and staff who changed roles or left a department. Those are the most likely to have stale permissions that still matter.

What to verify: Before trusting an account to remain live, verify who owns it, what system it reaches, whether it has been used recently, and whether a current teaching or operational need still exists. If you cannot answer those questions quickly, the account deserves recertification.

Decision rule: If the account no longer supports an active role, course, or application, retire it. If the account still supports a current function but the scope is too broad, reduce access rather than leaving the full entitlement in place.

Practitioner takeaway: The safest default is to treat unused staff access as expiring unless a current business owner can justify it, because stale access tends to survive longer than the process meant to govern it.

Related resources from NHI Mgmt Group

• How should teams reduce the risk of orphaned service accounts and stale tokens?
• Why do unused SaaS accounts create security risk?
• How should teams handle unused SaaS accounts without disrupting business work?
• Why does account takeover risk increase when customer accounts sit unused for long periods?