The Account Is Disabled. Is the Former Employee Really Locked Out?

An employee leaves on Friday. IT disables the company login. The checklist says “complete.”

But who owns the overnight reporting job they configured? Does their vendor portal use a separate password? Has anyone checked whether an already signed-in application still works?

For a tribal enterprise, casino, or growing business, offboarding should close access without breaking operations or handing sensitive records to the wrong person. The practical goal is an access closeout, not just an account change.

1. Assign one owner and an exact cutoff

Name a person accountable for coordinating HR, IT, security, department management, and vendor contacts. Record the approved cutoff time and the systems in scope. Include contractors, temporary workers, and personnel moving between business units.

Use a small register: system, account, access owner, removal action, completion time, and verification evidence.

Start with identity, email, remote access, privileged tools, payroll, finance, and business-critical applications. Then check independently managed vendor portals. Ask the departing person’s manager what was actually used, rather than assuming the central account directory tells the whole story.

For tribal organizations, also identify who has authority over each record set. A casino operations manager should not automatically receive access to unrelated tribal government or employee records simply because an account is being closed.

2. Close sessions, not only the sign-in door

Account disabling and session termination are related but different actions. Microsoft explains that applications may issue their own session tokens and that Microsoft Entra ID cannot directly revoke a session token issued by an application. App-side controls can therefore matter when removing access. See Microsoft’s access-revocation guidance.

Build the closeout around your actual environment:

• Block new sign-ins and remove privileged roles.

• Use supported controls to revoke sessions and refresh tokens.

• Deactivate local accounts in applications that do not rely entirely on the central identity provider.

• Remove remote-access and vendor-support privileges.

• Check enrolled devices and use approved management actions where appropriate.

Do not promise an immediate universal logout. Google notes that resetting sign-in cookies can take up to an hour to sign users out of current Gmail sessions, with timing varying for other applications. It also warns that a third-party single sign-on session may still allow access unless that session is terminated. See Google Workspace’s security-settings guidance.

3. Separate human access from operational credentials

A reporting script, backup connector, website integration, or payment workflow may keep running under credentials the departing employee could access. Disabling the employee’s ordinary login is not proof that those credentials are closed out.

Ask the application owner to identify shared passwords, API keys, certificates, service-account keys, and other reusable secrets the person knew or could retrieve. Determine what must be revoked or replaced, who owns the workload, and how to test continuity.

Google Cloud warns that service-account key files can be copied and that handing keys between people increases the risk of copies remaining in mailboxes, chat histories, or other locations. Treat potentially retained copies as part of the departure review, not as credentials automatically removed with the employee’s account. See Google Cloud’s service-account key guidance.

For a planned departure, coordinate credential replacement and test the dependent workflow. If compromise or misuse is suspected, follow the incident-response process and prioritize containment rather than leaving risky credentials active for convenience.

Avoid replacing one employee-owned dependency with another. Assign a documented business owner and an approved credential-management process.

4. Preserve records without preserving unnecessary access

Before deleting an account, make an explicit decision about mailbox content, files, business records, retention obligations, and ownership. Restrict any transfer to authorized recipients and the minimum necessary information.

Microsoft’s former-employee guidance distinguishes blocking access, preserving mailbox content, transferring access to OneDrive and Outlook data, and ultimately removing an account or license. Treat these as separate decisions, not a single delete button. See Microsoft’s offboarding checklist.

For tribal enterprises, make the authority decision visible: which entity controls the information, who approves the transfer, and where the retained material belongs. Follow the organization’s policies and applicable requirements; do not invent a universal retention period.

Record exceptions with an approver, purpose, expiration date, and compensating controls. If a business workflow needs continuity, migrate it to an approved organizational arrangement rather than leaving a former employee’s login active.

5. Verify the closeout and the business still works

NIST’s personnel-termination control addresses disabling access, revoking credentials, retrieving security-related property, and retaining access to organizational information previously controlled by the departing person. That combination reinforces the need to protect both access boundaries and continuity. See NIST SP 800-53 Rev. 5, control PS-4.

Have an authorized administrator verify account state, role removal, session-revocation results, and application-side deactivation. Use approved administrative evidence or controlled tests, not the former employee’s password.

Then confirm critical work still runs: reports arrive, backups complete, integrations authenticate, and the right owner can administer them. Track unresolved items with a named owner and deadline.

Start with one departure

Review the most recent employee or contractor departure. Can you show what was removed, what was retained, who approved each transfer, and how completion was verified?

If the answer lives in scattered messages, improve the closeout process before the next departure.

NativeCyber brings native-owned cybersecurity expertise to practical governance, data sovereignty, and cyber resilience. If your organization wants a second set of eyes on its offboarding process, connect with NativeCyber to identify access gaps and build a closeout checklist your team can use.