Search the departing developer's mailbox for sign up, welcome and billing messages, review single sign on and OAuth grants, look at expense and card records, and ask them directly. Then claim each account into a company owned identity or close it. Shadow accounts are services running outside your inventory, often tied to one person's email.
What a shadow account is
It is an account for a tool or service that someone set up for work without it going through your normal procurement or identity process. Examples include a trial of a design tool, a free tier of a monitoring service, a personal cloud project, a package registry account under a private email, or a webhook relay.
They are rarely malicious. They become a problem when the person leaves and the account holds company data, receives alerts, or is the only owner of something that production depends on.
Where evidence hides
| Source | What to look for |
|---|---|
| Work mailbox | Welcome emails, password resets, invoices, security alerts |
| Identity provider | Applications the person signed in to, and OAuth consents they granted |
| Source host | OAuth apps and GitHub Apps they authorized or installed |
| Expense and card records | Subscriptions charged to a company card or reimbursed |
| Browser or password manager exports | Where the company manages these, entries labeled for work |
| Cloud consoles | Projects or accounts created under a personal login |
| DNS and certificate records | Records they created pointing at third party services |
Respect privacy and policy. Search only company systems you are entitled to review, and follow your own rules for accessing a departing employee's mailbox. Ask HR or counsel if unsure.
A process
- Before the last day, run the searches and build a list.
- Ask the person to confirm and add to it, using the exit conversation questions.
- For each account, decide: keep, migrate or close.
- Keep means transferring ownership to a team address, adding at least two admins, and moving billing to a company method.
- Migrate means creating the equivalent in an approved tool and moving data.
- Close means exporting what you need, deleting the account and cancelling billing.
- For anything tied to an OAuth grant, revoke the grant.
- Record each account and its outcome.
- Rotate any credentials stored in or shared with the account.
Prevent the next set
- Give people an approved tools list and a fast way to request additions. Speed reduces workarounds.
- Require work identity sign in for all SaaS, and block personal sign in where you can.
- Use a shared mailbox address for vendor registrations, not an individual's.
- Review OAuth app consents in your identity provider each quarter.
- Add a "tools I signed up for" field to the handover document.
What to avoid
Do not panic and delete everything. Closing an account that hosts a live webhook can break production. Disable first, observe, and then close.
Quick check
Are shadow accounts always against policy?
Not necessarily. They are often well meant. The issue is that nobody else owns or can recover them.
Should I read the leaver's mailbox?
Only within your policy and local rules. Check with HR or counsel first.
Safeguard's asset discovery can help you find services and assets outside your known inventory. A free scan is available at gold.safeguard.sh/scan.
Last reviewed: 19 October 2026.
