Employee offboarding security: the orphaned account nobody disabled

A salesperson left the company 3 months ago. Their Microsoft 365 login still works. Their CRM token still syncs contacts to a personal laptop nobody can see. They still know the shared Wi-Fi password and the shared admin password that half the office uses. Nobody disabled the account, because offboarding was treated as an HR checklist item and the IT half of it fell through a gap. That account is now an orphaned credential, live and forgotten, and it is exactly the kind of access an attacker or a disgruntled former employee reaches for first.

Offboarding is an identity control. It is not an HR courtesy or a nice-to-have on the last-day checklist. The gap between “walked out the door” and “access actually revoked” is where the risk lives, and for most small and mid-size organizations that gap is measured in weeks or months, not minutes.

This post covers why ad-hoc offboarding fails, the specific access surfaces people forget and what a documented, measured deprovisioning process looks like.

Why ad-hoc offboarding fails

Offboarding fails in a predictable way. HR knows the person left. The manager knows. IT sometimes gets told and sometimes does not. When IT does get the ticket, it usually says “disable so-and-so” with no defined list of what “disable” covers. So the primary email account gets blocked and everyone moves on, while a dozen other access surfaces stay live.

The failure modes cluster:

• No single owner. Offboarding sits between HR, the hiring manager and IT, so each assumes another party handled the technical revocation.
• No defined scope. “Disable the account” gets read as “block the email login” and nothing else. Nobody enumerated the SaaS apps, the shared credentials or the enrolled devices.
• No verification. The ticket gets closed when someone believes the work is done, not when every surface is confirmed revoked with evidence.
• No timing standard. Without a target, deprovisioning slides. A departure on Friday gets handled “next week” and next week never fully arrives.

The result is orphaned accounts. Industry surveys of identity and access management consistently find that a majority of organizations have active accounts belonging to former employees, and that many breaches trace back to credentials that should have been dead. When access lingers for months, the credential is not just a loose end. It is an unmonitored door.

The access surfaces people forget

The primary email account is the easy part. Everyone remembers to block the Microsoft 365 login. The risk lives in the surfaces that do not have a bright line in front of them.

SaaS tokens and OAuth grants

Disabling the primary account does not automatically kill every downstream app. A CRM, an accounting platform or a file-sharing tool connected through OAuth can keep a live token that syncs data long after the source account is blocked. If the departing employee authorized an app on a personal device, that grant can survive until it is explicitly revoked. Each SaaS app is its own deprovisioning task.

Shared credentials the person knew

Shared logins are the quiet failure. A shared Wi-Fi password, a shared admin account, a service login that three people use, the front-desk password taped to a monitor. Disabling one named user does nothing to these, because the departing person still knows the secret. Every shared credential the person had access to has to be rotated, not just their personal account disabled.

MFA devices and registered methods

If the departing employee’s phone still holds the authenticator registration, or their number is still a recovery method, they retain a path back in. MFA methods have to be reclaimed and reset as part of offboarding, or the second factor becomes their factor.

Personal-device sync and BYOD

Under any bring-your-own-device arrangement, company mail and files may have synced to a personal phone or laptop. Blocking the account does not pull that cached data back. A selective wipe through mobile device management is the only clean way to remove company data from a device the company does not own.

VPN and remote access

Remote access tooling often lives outside the primary identity system. A VPN client certificate, a remote desktop gateway account or an always-on remote support agent can grant a path into the network that the email block never touched.

What a documented, measured process looks like

The fix is not heroics. It is a written process with a named owner, a defined scope and a timing standard you actually measure against.

Two numbers matter. The first is your target time-to-deprovision. A defensible standard for a small or mid-size organization is full deprovisioning of every access surface within 24 hours of the effective departure, and for a high-risk or involuntary termination, within the same hour the person is walked out. The second is your orphaned-account count, which should be verified at zero on a recurring access review, not assumed.

A documented process has these properties:

• One owner per departure. A single person is accountable for driving the checklist to completion, even though HR triggers it and IT executes the technical steps.
• A defined checklist, not a verbal instruction. Every access surface is enumerated in advance: primary identity, MFA methods, mailbox and files, each SaaS app, shared credentials, VPN and remote access, devices.
• Session and token revocation, not just password resets. Disabling an account without revoking active sessions leaves live tokens working until they expire. The revocation has to be explicit.
• A timestamped completion log. Each step is recorded as done, by whom and when. The ticket closes only when every surface is confirmed, which turns “we think we handled it” into evidence.
• A recurring access review. A periodic sweep for accounts belonging to people who no longer work here catches the ones that slipped, before they become a 3-month-old orphan.

The howTo below walks the sequence: disable and revoke sessions, reset MFA, preserve mailbox and files, remove from every SaaS app and rotate shared credentials, revoke remote access, collect and wipe devices, then log completion with a timestamp and an owner.

Offboarding is identity, and identity is measurable

Treating offboarding as an identity control changes how it gets built. It gets a checklist, an owner, a target time and a log, the same way any other control does. It stops being the thing that happens whenever someone remembers, and becomes the thing that provably happened within 24 hours, every time, with evidence.

For organizations running Microsoft 365 identity, this fits inside the broader identity posture that governs joiners and movers as well as leavers. Our post on managed identity for a 50-person company covers how the lifecycle hangs together, and our post on endpoint privilege management covers the device and privilege side of the same problem.

If you are not confident every departed employee’s access is actually dead, or you cannot produce a log proving it, talk to us about your identity and offboarding posture. We can scope the orphaned-account risk and stand up a documented process that closes the gap between the last day and the last live token.