The problem
Access that outlives the employment
When an employee leaves, the AD account is often one of the first things to be disabled. But a modern IT environment consists of far more than one login: cloud services with their own user directories, shared mailboxes, business systems, test environments, and integrations that were never connected to central governance.
Every access that outlives the employment is an open door. Some are misused by former employees – but the bigger risk is attackers taking over dormant accounts. Nobody misses them in daily work, so the misuse is discovered late.
The typical gaps
Where it most often goes wrong
- Systems without integration: access created directly in business systems and cloud services that nobody removes, because nobody knows it exists.
- Externals and temps: consultants and hourly workers outside the regular HR process, where no end date triggers a closure.
- Shared and service accounts: passwords the former employee still knows – but that nobody gets around to changing.
- Role changes: employees who change departments and bring old access with them – year after year.
The solution is a process – not a checklist
An offboarding that depends on a manager remembering to write to IT will fail sooner or later. The durable solution is to make the HR system the master: the end date is registered in one place and automatically triggers deactivation across all connected systems, the same day, with documentation that it happened.
For the systems that cannot be integrated, the answer is regular recertification: the system owner confirms at fixed intervals that each access is still justified. That catches both the forgotten accounts and the access that has accumulated through years of role changes.
How much forgotten access do you have?
The honest answer is that few organizations know. An IAM Healthcheck gives you an actual picture of the state of things – and a prioritized plan for the clean-up.
