Disabling a departing employee's work account is an important action. It is not an inventory of every external service they used.
A project-management tool may have its own local login. A vendor account may send recovery messages to a work address. A business workflow may depend on a person who was its only administrator. Offboarding needs to answer these questions explicitly.
Start from known ownership
NIST's Cybersecurity Framework connects identity and access management with broader risk management. For an offboarding process, that means joining people, applications, and accountable owners rather than handling each as a disconnected list.
Use the employee's manager and application inventory as starting points. Exposure evidence can identify additional account-service associations worth reviewing, but it is not a complete application list or proof that an account remains usable.
A record from years ago may still mention an address after the relationship has ended. Preserve that distinction in the ticket.
Separate disablement from transfer
For each relevant external service, decide whether the account should be disabled, transferred, or retained under a documented business need.
| Question | Why it matters |
|---|---|
| Who owns the service? | Someone must authorize the change |
| How does the user sign in? | Central disablement may not cover a local account |
| Who controls recovery? | A dormant address should not become an unmanaged recovery dependency |
| What must be transferred? | Projects and records may need another accountable owner |
Do not delete business data simply to make an account disappear. Follow the organization's retention and transfer procedure, with the appropriate owner involved.
Review the routes that survive a departure
Check delegated access, integration permissions, shared resources, and recovery contacts through approved administration tools. Where an account has active sessions or application tokens, follow the provider's documented revocation process.
For a hypothetical design contractor, disabling company email may not remove a locally authenticated account at a design platform. The application owner needs to confirm that account's access outcome.
Avoid testing old credentials to see whether the person could still sign in. Administrative confirmation is safer and produces a more useful record.
Define what completion means
A completed offboarding review identifies the account owner, systems reviewed, actions taken, transferred responsibilities, and unresolved exceptions. “Email disabled” can remain a completed checklist item without becoming a claim about every service.
Revisit exceptions on a named date. An account retained for business continuity should have a current custodian, not remain associated with a person who has left.
Read shared-mailbox access and contractor account boundaries. Offboarding is strongest when it finishes the access relationships that onboarding created.