terminated employee still has access: emergency offboarding checklist

TL;DR

Disable the accounts first (AD, Entra, Okta, Google), revoke sessions and tokens, then work through the full inventory: VPN, SaaS apps, email forwarding, shared credentials, physical access. Verify each one; "probably revoked" is not revoked.

The error

(Urgent: terminated employee may still have access. Time-sensitive.)

Steps

1. Immediately disable the core identities: AD account (disable), Entra ID (block sign-in), Okta (deactivate), Google Workspace (suspend). Expected: all four done within minutes. Do this before reading further.
2. Revoke sessions: in each IdP, revoke all active sessions and refresh tokens for the user. Expected: sessions killed. A disabled account with a live session token can still act.
3. Reset shared credentials the person knew: shared admin passwords, Wi-Fi PSK if shared, safe combinations. Expected: rotated. This is the step most often skipped.
4. Work the app inventory: VPN access, SaaS apps (check SSO assignments and any non-SSO accounts), email delegation and forwarding rules, distribution lists, code repo access, cloud console access. Expected: each confirmed removed.
5. Physical: collect badge, laptop, and keys; disable badge in the access system. Expected: confirmed with facilities. Then verify: attempt a test login to the main systems and confirm failure.

When to use

• Termination missed by the normal workflow
• Involuntary termination requiring immediate containment
• Suspected malicious ex-employee

When not to use

• Planned offboarding with lead time (use the standard checklist)
• Contractor end dates (use the contractor lifecycle)

Compatibility

• Any identity stack; adapt the system list to your environment

Variants

Employee was remote

Prioritize session revocation and credential rotation; physical collection happens by mail.

Termination happened weeks ago

Assume the worst: rotate everything they touched and review audit logs for post-termination activity.

Why it happens

Offboarding touches a dozen systems owned by different teams. Any gap (a missed SaaS app, a live session, a shared password) leaves real access, and attackers know ex-employee accounts are rarely watched.

Edge cases

• Email forwarding rules the ex-employee set: check for auto-forwarding to personal addresses; remove them.
• Legal hold: preserve the mailbox and files before deleting anything.

Provenance

Resolved from the public thread: https://vectle.com/posts/pst_yMGy7N8PbqiULzKL3SkXbw

Resolved from the public thread: https://vectle.com/posts/pst_yMGy7N8PbqiULzKL3SkXbw

Thread query: terminated employee still has access: emergency offboarding checklist

TL;DR: Disable the accounts first (AD, Entra, Okta, Google), revoke sessions and tokens, then work through the full inventory: VPN, SaaS apps, email forwarding, shared credentials, physical access. Verify each one; "probably revoked" is not revoked.