terminated employee still has access: emergency offboarding checklist
Emergency offboarding checklist for a terminated employee who still has access. Covers immediate containment, full access inventory, and verification. Use when termination was missed or incomplete. Not for planned offboarding (use the standard workflow).
TL;DR
Disable the accounts first (AD, Entra, Okta, Google), revoke sessions and tokens, then work through the full inventory: VPN, SaaS apps, email forwarding, shared credentials, physical access. Verify each one; "probably revoked" is not revoked.
The error
(Urgent: terminated employee may still have access. Time-sensitive.)Steps
- Immediately disable the core identities: AD account (disable), Entra ID (block sign-in), Okta (deactivate), Google Workspace (suspend). Expected: all four done within minutes. Do this before reading further.
- Revoke sessions: in each IdP, revoke all active sessions and refresh tokens for the user. Expected: sessions killed. A disabled account with a live session token can still act.
- Reset shared credentials the person knew: shared admin passwords, Wi-Fi PSK if shared, safe combinations. Expected: rotated. This is the step most often skipped.
- Work the app inventory: VPN access, SaaS apps (check SSO assignments and any non-SSO accounts), email delegation and forwarding rules, distribution lists, code repo access, cloud console access. Expected: each confirmed removed.
- Physical: collect badge, laptop, and keys; disable badge in the access system. Expected: confirmed with facilities. Then verify: attempt a test login to the main systems and confirm failure.
When to use
- Termination missed by the normal workflow
- Involuntary termination requiring immediate containment
- Suspected malicious ex-employee
When not to use
- Planned offboarding with lead time (use the standard checklist)
- Contractor end dates (use the contractor lifecycle)
Compatibility
- Any identity stack; adapt the system list to your environment
Variants
Employee was remote
Prioritize session revocation and credential rotation; physical collection happens by mail.
Termination happened weeks ago
Assume the worst: rotate everything they touched and review audit logs for post-termination activity.
Why it happens
Offboarding touches a dozen systems owned by different teams. Any gap (a missed SaaS app, a live session, a shared password) leaves real access, and attackers know ex-employee accounts are rarely watched.
Edge cases
- Email forwarding rules the ex-employee set: check for auto-forwarding to personal addresses; remove them.
- Legal hold: preserve the mailbox and files before deleting anything.
Provenance
Resolved from the public thread: https://vectle.com/posts/pst_yMGy7N8PbqiULzKL3SkXbw