Offboarding: What Gets Missed

A disabled account in your identity provider closes federated applications. Everything else continues.

What survives a disabled directory account

Applications with local passwords, not federated. The user signs in directly and the directory is not consulted.

OAuth grants the user made, which continue to hold access tokens.

Personal access tokens and API keys they generated.

Shared account credentials they know.

Service accounts they created and used personally.

Subscriptions on their corporate card, which continue billing.

Subscriptions on their personal card, reimbursed, holding company data.

External systems — client portals, partner platforms, supplier accounts, regulatory filing systems.

Forwarding rules set on their mailbox before departure.

Ownership of documents, applications, integrations and automations.

Devices, including personal devices with company data.

Physical access — badges, keys, and building systems.

The checklist

Ordered by how much damage each causes if missed.

Disable directory and SSO access. Immediately, at the effective time.

Revoke OAuth grants, in every platform. This one is the most commonly missed and the most consequential.

Revoke tokens and API keys they created.

Close or transfer local-password application accounts, from the register's list of non-federated applications.

Rotate shared credentials they had access to.

Reassign service accounts they owned to a team, or retire them.

Cancel subscriptions on their card, identified from expense data.

Reassign application ownership, from the register.

Transfer document and repository ownership.

Check mailbox rules before suspending, for forwarding set up in advance.

Recover devices and wipe remotely regardless of recovery.

Revoke physical access.

The data question

What of theirs does the organisation need, and what should be deleted.

Mailbox retention has a defined period in most organisations and frequently defaults to indefinite.

Personal files in company storage.

Company files in their personal accounts, which you cannot reach and should have prevented.

Agree the retention period per data type in advance, rather than deciding for each departure.

Timing

Immediate for anything involving risk: a dismissal, a departure to a competitor, anyone with privileged access.

Coordinated with the effective date for ordinary departures, which means the process starts before the last day.

Never before the person is told, which happens and is both cruel and a signal to everyone watching.

Complete within a defined window — days, not weeks — with a completion record.

The audit

Quarterly, look for accounts belonging to people no longer in the directory.

In every application, not just the federated ones.

Compare the application register's user lists against the current directory.

Every orphan found is an offboarding failure, and the application it was found in tells you which step is not running.

Report the count and the trend. It is the only objective measure of whether offboarding works.

The pre-departure conversation

Some offboarding steps are far cheaper before the person leaves than after, and they require asking them directly.

What do you own that others will need — documents, automations, scheduled reports.

What accounts did you register with external services on the company's behalf.

What is running under your name that will break when your account closes.

What subscriptions are on your card.

Who should take over each, in their view.

Fifteen minutes, a week before the last day. It produces information no system holds and it is the difference between a clean handover and three weeks of discovering broken automations.

Measuring whether it completed

Offboarding processes are usually measured at initiation, which is the wrong end.

Time from effective date to last access removed, per leaver.

Proportion of applications covered by automated deprovisioning, which is the federation rate in another form.

Manual steps outstanding after the target window.

Orphaned accounts found in the quarterly audit, grouped by application, which names exactly where the process fails.

Devices unrecovered after thirty days.

Report the distribution, not the average. One leaver whose access took four months to remove is the finding, and an average hides it entirely.