Most businesses know how to handle the human side of employee departures pretty well - hopefully a nice going-away or retirement party, the laptop gets returned, and HR updates the org chart. But the tech side has plenty to take care of as well and if it isn't done right things can get a little messy.
When someone leaves your company, their access to your systems doesn't disappear on its own. Their Microsoft 365 license is still active, logins to your various tools still work, the shared password for your social media accounts haven't been rotated.
It's a common gap MSPs encounter when they start working new clients, and it's usually because there just isn't a process in place to make sure someone is ticking all the boxes everytime.
Digital access doesn't come with an expiration date. Every account, login, and permission an employee accumulates over their time with you stays active until someone manually turns it off. The longer that goes unchecked, the more exposure you're carrying.
The security angle gets talked about a lot, so we'll keep it brief. A former employee's account, even one left open accidentally, is a potential entry point. Hackers specifically look for inactive credentials because they're less likely to trigger alerts. A login that hasn't been used in four months is less suspicious to your systems than one that's being actively monitored.
Then there's the cost angle. Software subscriptions are often per-user so if you have 15 active Microsoft 365 licenses, but three of those belong to people who no longer work for you, that's a good chunk of change every month for licenses that serve no purpose. And then you probably need to multiply that across the various programs in use in your org.
The concern can be even bigger for businesses in industries with compliance requirements like medical practices dealing with HIPAA, legal firms with client confidentiality obligations, and CPAs handling tax data. Unrevoked accounts are now a liability.
This is the core of what needs to happen every time an employee leaves, whether the departure is planned or sudden.
Most of the risk from poor offboarding is accidental. An old account gets compromised, a subscription keeps billing, a shared password never gets changed. A consistent process closes those gaps before they become problems.
That last step of maintaining a master access list will help make every future off-boarding faster and cleaner.
When you don't have a running record of who has access to what, every departure becomes a scramble. Someone has to try to reconstruct everything from memory and things will inevitably be missed. When you do have it, the off-boarding checklist becomes a simple matter of working down the page rather than guessing.
It's also useful beyond off-boarding. When you onboard someone new, you'll be granting access to the same systems. When a role changes, you need to know what to add and what to remove. The list pays off in multiple directions!
If you're not sure where to start, the master access list is the best first step. Spend an hour documenting who has access to what right now, and you'll have something concrete to work from the next time someone gives notice.