When someone leaves, remove access in order of damage potential: identity provider and email first, then production and code access, then shared secrets and tokens, then devices and data. Do the first group within the hour. The rest should be done within a day and checked off by a second person.
Before the last day
- Get a list of everything the person can access. Your identity provider shows single sign on apps. It will not show everything.
- Ask their manager for accounts that sit outside it: personal tokens, vendor portals, shared mailboxes, cloud consoles with local users.
- Decide who inherits files, repositories, scheduled jobs and on call duties.
- For a hostile departure, move all of this to the hour of notice, not the last day.
The first hour
- Disable the identity provider account. Disable, not delete, so you keep the audit trail. End all active sessions and revoke refresh tokens.
- Reset or revoke multi factor devices. Remove registered phones, security keys and authenticator seeds.
- Suspend email and chat access. Set up forwarding or delegate access to the manager under your retention policy.
- Remove production and cloud console access. Check both single sign on roles and any local users.
- Remove source control access. Organisation membership, deploy keys the person created, and personal access tokens that act inside the organisation.
The rest of the first day
- Rotate shared secrets they knew. Shared admin passwords, signing keys, API keys held in a password manager they could open. Prioritise by blast radius.
- Audit tokens they created. CI tokens, webhooks, service accounts and OAuth apps often keep working after the human is disabled. List credentials by creator and re-issue them under a team owned identity.
- Recover devices. Lock or wipe managed devices according to policy. For personal devices, remove work profiles and cached credentials rather than wiping the whole phone.
- Review recent activity. Look at the last thirty days of downloads, exports, large repository clones and forwarding rules. You are looking for the unusual, not for proof of wrongdoing.
- Transfer ownership. Calendar invites, document ownership, domains, SaaS admin roles and on call schedules.
What people forget
Service accounts that were set up with a personal email as the owner. Recovery emails for company accounts that point to a personal address. Third party tools bought on a personal card. Each of these is a quiet way for access to outlive employment.
Run the same list for contractors. Their access often sits outside the identity provider altogether.
Keep the evidence
Record the time each step was done and by whom. For compliance programmes, access removal timing is a standard audit sample, and a ticket with timestamps answers it in one screenshot.
Quick check
Disable or delete the account?
Disable first. Delete after your retention period, once ownership of everything has moved.
Do we need to rotate every secret?
Rotate the ones the person could read or had admin power over. Use your inventory to rank them, and do the highest impact first.
Last reviewed: 19 October 2026.
