Joiner, Mover, Leaver
The three events where access changes. Most organisations handle joiners well, movers badly, and leavers incompletely — and the gaps compound.
Procedure · 683 words
Access and leavers
Disabling the directory account closes federated applications and nothing else. Twelve things that survive it, plus the review process that produces removals rather than a certification rate.
7 records · 4,943 words
Offboarding: What Gets Missed
Disabling the directory account is the first step and it is frequently treated as the last. Twelve things that survive it, in the order they cause problems.
Checklist · 639 words
Orphaned and Dormant Accounts
Accounts belonging to nobody, or to someone who stopped using them. One is a security problem, the other a cost problem. Different responses.
Procedure · 722 words
Admin and Privileged Access in SaaS
Every application has administrators, and nobody maintains a list of who they are. This is the highest-consequence gap in most SaaS estates.
Procedure · 722 words
Contractors, Vendors and Third Parties
People with access who are not employees, whose departure nobody tells you about. The category where offboarding fails most reliably.
Analysis · 697 words
Access Reviews That Are Not Theatre
The standard review sends managers a list they approve without reading. Three changes make the exercise produce actual removals.
Procedure · 711 words
A Departing Employee's Data
Their mailbox, their files, their accounts. What to keep, for how long, and the decisions that are much easier made in advance than at the point of departure.
Procedure · 769 words