Volunteer and Seasonal Workforce Access Controls

Volunteers and seasonal workers often get real access to real data on phones and laptops the organisation will never manage, and nobody owns removing that access when the season or the event ends. Charities, festivals, sports clubs, retailers at peak, agricultural employers, election offices and disaster response teams all bring in large numbers of short lived users at once, frequently with no HR record, no corporate device and a few minutes of onboarding. This guide covers the narrow problem of giving these people just enough access, on devices you do not control, and taking it away reliably afterwards. It is written for IT leads, IAM practitioners and operations managers in organisations that rely on volunteers or seasonal staff. Managed contractor engagements are covered in the Contractor Identity Lifecycle Guide; this page deals with the cases where those assumptions do not hold.

Key takeaways

Start with a roster, not accounts. A single list of every volunteer and seasonal worker, with an owner, a role and an end date, is the system of record that drives both joiner and leaver steps.
Design access around the device you cannot manage. Browser-only access, app-level protection and no local copies of personal data are the realistic controls when the phone belongs to the volunteer.
Make every account expire by default. Set an end date at creation, matched to the season or event, so access lapses even when the leaver step is forgotten.
Never share accounts across a cohort. Individual named accounts, even very cheap ones, are what make revocation, investigation and accountability possible.
Run a short, scripted leaver sweep at the end of every season. Disable accounts, revoke sessions, remove work data from personal devices and close shared drive links on a fixed date, then measure what was missed.

Why volunteers and seasonal staff break normal lifecycle controls

Standard joiner, mover and leaver automation assumes an HR feed, a line manager and a corporate laptop. Short lived workforces lack all three. See the Joiner-Mover-Leaver Guide for the general model.

No authoritative source: volunteers are recruited by a coordinator using a spreadsheet, a sign-up form or a volunteer management system; seasonal staff may come through an agency or a payroll system that the identity team never sees.
Bulk, time-boxed onboarding: hundreds of people start in the same week and leave on the same day, which encourages shared logins, generic passwords and access granted "for now".
Personal devices by default: the device that reads the rota, the donor list or the stock system is the volunteer's own phone, often shared with family members and rarely updated.
Weak end signals: volunteers drift away rather than resign, events end without an offboarding step, and returning seasonal staff tempt teams to leave accounts open.
Low assurance, high trust: a volunteer may have access to vulnerable people's records, cash handling or safeguarding data despite minimal identity checks.

An unused account with a reused password is a valid account, which ATT&CK lists as T1078 Valid Accounts (T1078.004 Cloud Accounts for SaaS and cloud identity providers). The Leaver Retained Access Incident Playbook covers what to do when a former worker's access is found still active.

Choosing an identity model for each group

Different short lived groups need different levels of identity. Decide the model before the season starts, because it determines how easy removal will be.

Group	Typical access	Identity model	Device stance	End date anchor
Event day volunteers (stewards, marshals)	Rota, briefing pack, radio or messaging group	No organisational account; information sent through a messaging tool or a public, non-sensitive page	Personal phone, nothing sensitive stored	Event end date; remove from messaging groups
Regular volunteers handling personal data (helpline, casework, fundraising)	Case or donor records, email, shared files	Named account in your identity provider, flagged as volunteer, MFA required	Personal device with browser-only or app-protected access	Review every 3 to 6 months; disable after inactivity
Seasonal retail, warehouse or farm staff	Scheduling, time clock, point of sale, stock tools	Named account, often created from payroll or agency roster; shared device sign-in	Shared managed device on site, personal phone for rota only	Contract end date from payroll or agency
Short-term office temps	Email, internal apps	Full workforce account, flagged as temporary	Issued device where possible; otherwise browser-only	Assignment end date from the agency
Volunteer trustees and committee members	Board papers, finance approvals, admin consoles in small charities	Named account with phishing-resistant MFA; privileged roles held separately	Personal devices common; treat as high risk	Term of office; review at each election

Decision rule: if a role never needs personal data or financial systems, do not give it an account at all. If it does, give each person a named account with MFA and an end date, and push the device question to session controls rather than device management. If the person administers systems, they are not a lightweight user: apply your privileged access standard regardless of their volunteer status.

Small organisations with a handful of volunteers can run this from one spreadsheet and the admin console of their productivity suite. Large charities, councils and retailers with thousands of seasonal joiners should feed the roster into their identity governance tooling so that expiry and removal are automated. The Cybersecurity for Charities and Non-Profits Guide covers the wider charity context.

Lightweight joiner controls

Record the person on the roster first: name, role, coordinator (the accountable owner), start date, end date, contact number and whether they will handle personal data. No roster entry, no account.
Proportionate identity checks: match the check to the access. Safeguarding roles may already require background checks through the relevant national scheme; for data access, at least confirm the person in a video call or in person against the details the coordinator holds. See the Identity Proofing and KYC Guide.
Create a named account with an end date: use a naming convention or attribute that marks the account as volunteer or seasonal (for example a dedicated organisational unit, group or employee type) so policies and reports can target the whole population.
Enrol MFA at first sign-in: authenticator app push with number matching, platform passkeys or security keys. NIST SP 800-63B Revision 4 requires verifiers to offer at least one phishing-resistant option at AAL2 and classes authentication over the public telephone network as restricted, so treat SMS codes as a fallback, not the default.
Assign access through a role group or package, never directly: one group per role (helpline, shop floor, event logistics) makes the leaver step a single removal and keeps permissions consistent.
Brief in five minutes: what data they can see, what not to download or screenshot, how to report a lost phone, and the date their access will end.

Controlling data on devices you do not manage

Asking volunteers to enrol their personal phones in full device management is rarely acceptable and often unnecessary. The NCSC's bring your own device guidance makes the point that the organisation owns the data while the device belongs to the user. Control the data and the session instead. Platforms are listed alphabetically; settings are taken from each vendor's own documentation as of November 2026.

Google Workspace

Context-Aware Access: access levels can combine IP range, device policy (for example company-owned, encrypted or password-protected), device operating system and geographic origin. Core Workspace services are checked continuously after access is granted; SAML apps are checked at sign-in.
Personal Android devices under advanced management: a work profile is always required, so work apps and data are separated from personal apps.
Auto wipe: work data can be removed automatically if a device does not sync for a set number of days or falls out of compliance; on personal devices with a work profile, only the work profile is wiped and personal data remains.
Availability: Context-Aware Access policies apply to users on Frontline Standard or Plus, Enterprise Standard or Plus, Education Standard or Plus, Enterprise Essentials Plus or Cloud Identity Premium editions; advanced mobile management settings require advanced management for the users concerned.

Microsoft 365 and Entra ID

Unmanaged device access in SharePoint and OneDrive: the options are Allow full access, Allow limited, web-only access and Block access. Limited, web-only access gives browser-only access with no ability to download, print or sync files.
Conditional Access session control "Use app enforced restrictions": applied to Office 365 for unmanaged devices, it supports limiting SharePoint and OneDrive access, limiting email attachments in Outlook on the web and enforcing idle session timeout. Microsoft recommends creating the policy in Report-only mode first.
App protection policies for unenrolled devices: settings such as Restrict cut, copy, and paste and Save copies of org data apply to corporate data only, and a selective wipe removes company app data while leaving the app and personal data in place.
Availability: unmanaged device restrictions rely on Microsoft Entra Conditional Access, and app protection policies are an Intune capability; confirm licensing for these features against Microsoft's current plan pages.

Practical stance for most volunteer roles: browser-only access to files, no sync clients, idle timeout on unmanaged sessions, and no access at all to bulk export functions. Where a role must work offline (for example field surveys with no signal), use an app that supports work-data separation and remote removal, and keep the data set small. The BYOD Policy Template gives policy wording.

Shared devices and shared accounts

Seasonal staff often use shared on-site devices: tills, handhelds, kiosks and tablets in a shared office. The risk is not the shared device but the shared account behind it.

Pattern	Risk	Better option
One generic login per shop or site ("store1", "events")	No accountability; password known by every past worker; cannot be revoked per person	Individual accounts with fast sign-in on the shared device (badge tap, PIN plus device-bound credential)
Shared mailbox password given to a cohort	Former workers keep access until someone remembers to change it	Delegate mailbox access to named accounts through a role group
Spreadsheet of volunteer contact details shared by link	Link outlives the season and spreads beyond the team	Share with a group, not "anyone with the link"; set link expiry; review sharing at season end
Social media or fundraising platform login shared in a group chat	Account takeover after any member's device is compromised	Use the platform's role-based team features or a shared vault in a password manager with per-person access

See the Passwordless for Frontline and Shared Devices Guide and the Kiosk and Shared Device Security Guide for device-level options.

Leaver controls that work without HR

Because nobody resigns from a volunteer role, the leaver process has to be driven by dates and inactivity, not by a resignation event.

Expiry at creation: in Microsoft Entra entitlement management, access package assignments can expire on a date, after a number of days (0 to 3,660) or a number of hours; extension requests can require approval and cannot run past a fixed policy end date. In smaller tenants the same effect comes from a scheduled review of the roster end date column.
Inactivity trigger: disable volunteer accounts with no sign-in for a set period. CIS Controls v8.1 Safeguard 5.3 sets 45 days of inactivity for disabling dormant accounts; for event volunteers, shorter is better.
Coordinator attestation: each coordinator confirms, monthly or at season end, who on their list is still active. Unconfirmed accounts are disabled, not deleted, so returning volunteers can be restored.
Season end sweep: a fixed date in the calendar when every seasonal account without an extension is disabled in one batch.

Disabling is not enough on its own

Disabling an account does not immediately end every session. Microsoft documents that access tokens last one hour by default, that revoking sessions stops refresh tokens being used, and that application session cookies are issued by the application rather than by Entra ID. Google documents that suspending a Workspace user blocks access to services and blocks new email and calendar invitations, while email, documents and calendars are kept; suspended accounts continue to be charged, so delete accounts that will not return. A complete leaver step therefore covers:

Disable or suspend the account in the identity provider.
Revoke sign-in sessions and refresh tokens.
Remove work data from personal devices through selective wipe, work profile removal or app-level wipe.
Remove the person from role groups, shared mailboxes, messaging groups and external platforms (volunteer management systems, fundraising tools, social media teams) that are not connected to single sign-on.
Rotate any shared secret they knew: door codes, till PINs, shared Wi-Fi passwords and any shared platform passwords.
Transfer ownership of files they created to the coordinator before deletion.

The Employee Offboarding Security Checklist covers the full employee version; use it as the superset and cut it down for volunteers.

Implementation plan

Weeks 1 to 2, inventory: export every account and identify volunteers and seasonal users by group, organisational unit, naming pattern or sign-in history. Find generic and shared logins, and every file shared by public link.
Weeks 2 to 4, roster and ownership: build the roster, assign a coordinator to every person, and add end dates. Disable accounts nobody claims (disable, wait 30 days, then delete).
Weeks 4 to 6, session controls: pilot browser-only access for unmanaged devices with one volunteer team, using report-only or monitoring modes first. Roll back by excluding the pilot group if critical work breaks.
Weeks 6 to 8, MFA and shared accounts: require MFA for every named volunteer account, replace generic site logins with individual sign-in, and move shared platform credentials into a password manager.
Before each season, joiner pack: pre-create role groups, set the default expiry, prepare the five-minute briefing and test the leaver sweep on last season's accounts.
Season end, sweep and measure: run the leaver steps, then measure what remained active a week later and fix the gap in the process, not just the accounts.

Detection and measurement

Monitor the volunteer and seasonal population as a separate segment so that problems are visible rather than averaged away.

Sign-ins after end date: any successful sign-in from an account past its roster end date is an incident signal.
Bulk download or export: downloads, exports or large sync activity from volunteer accounts, especially from unmanaged devices.
New MFA methods or device registrations on volunteer accounts outside onboarding windows. See How to Detect MFA Method Registration Abuse.
Public link creation on folders holding personal data.

Metric	Target	Why it matters
Volunteer and seasonal accounts with an end date	100%	Expiry is the main control when leaver events do not happen
Accounts still enabled 7 days after season or role end	0	Measures whether the sweep actually works
Named accounts with MFA registered	100% for any role with personal or financial data	Removes the easiest takeover route
Generic or shared logins remaining	Falling to zero	Shared logins defeat revocation
Accounts with no coordinator	0	Orphaned accounts are never reviewed
Public sharing links on personal data folders	0	Links outlive the people they were made for

Framework mapping

Control area	NIST SP 800-53 Rev 5	NIST CSF 2.0	CIS Controls v8.1	ISO/IEC 27001:2022 Annex A
Roster, named accounts, expiry	AC-2 Account Management, AC-2(3) Disable Accounts	PR.AA-01	5.1 Establish and maintain an inventory of accounts, 5.3 Disable dormant accounts	5.16 Identity management
Role-based access and reviews	AC-6 Least Privilege	PR.AA-05	6.1 Establish an access granting process	5.18 Access rights
Leaver sweep	PS-4 Personnel Termination	PR.AA-01	6.2 Establish an access revoking process	6.5 Responsibilities after termination or change of employment
External and temporary personnel	PS-7 External Personnel Security	GV.RR-04	6.2	6.1 Screening
MFA	IA-2 Identification and Authentication (Organizational Users)	PR.AA-03	6.3 Require MFA for externally-exposed applications	8.5 Secure authentication
Unmanaged device data	AC-19 Access Control for Mobile Devices	PR.DS-01	3.3 Configure data access control lists	8.1 User endpoint devices

Common failure patterns

Accounts kept open for next season: returning volunteers are welcome, but an enabled account that sits unused for nine months is an easy target. Disable at season end and restore on return.
The coordinator is the only record: when the coordinator leaves, nobody knows who their volunteers were. Keep the roster in a shared, owned system.
Generic logins on tills and tablets: one password shared by every seasonal worker for years, never changed because changing it disrupts the shop.
Disable without session revocation: the account is disabled but the phone app keeps working until tokens or app sessions expire, or work data stays on the device.
Systems outside single sign-on forgotten: volunteer management platforms, fundraising tools, social media accounts and messaging groups are where former volunteers retain access most often.
Trustees treated as volunteers, not administrators: in small charities a trustee may hold global admin rights on a personal laptop with no MFA.

Practitioner checklist

Keep one roster of volunteers and seasonal staff with coordinator, role and end date.
Give accounts only to roles that need personal or financial data; use messaging or public pages for the rest.
Create named accounts only, tagged as volunteer or seasonal, with an expiry set at creation.
Require MFA, offering a phishing-resistant method, for every named account.
Limit unmanaged devices to browser-only access with idle timeout, or app-protected access with remote removal of work data.
Replace generic site logins and shared platform passwords with individual sign-in or a password manager.
Disable dormant accounts automatically and run a dated season end sweep that revokes sessions and removes device data.
Rotate door codes, PINs and shared secrets at the end of each season.
Report sign-ins after end date, bulk downloads and public links for the volunteer segment.

Volunteer and Seasonal Workforce Access: Lightweight Joiner and Leaver Controls for Unmanaged Devices