## TL;DR
Create the contractor in the contractor OU/group with an expiry date, assign only the VPN group (not employee groups), and set a calendar reminder for the end date. Contractors get time-boxed, least-privilege VPN access, never the employee profile.

## The error
```text
(Access request; no error. Contractor needs VPN.)
```

## Steps
1. Verify the request: sponsor (employee) name, business justification, and end date. Expected: all three present. No end date, no VPN; "indefinite contractor" is how access lingers.
2. Create or enable the contractor account in the designated contractor OU with account expiry set to the end date. Expected: expiry set. The expiry is the safety net.
3. Assign the contractor VPN group only. Expected: no employee groups. Check effective access; contractors must not inherit employee file shares or apps through nesting.
4. Send the contractor the VPN client, the gateway address, and setup instructions. Expected: contractor connects successfully. Test before their start date if possible.
5. Set a reminder for one week before expiry to confirm extension or revocation. Expected: reminder set. On the end date, disable the account and remove VPN group membership.

## When to use
- Contractor, vendor, or temp needs VPN
- Any non-employee remote access request

## When not to use
- Employee VPN setup (standard process)
- Permanent access (contractors are temporary by definition)

## Compatibility
- Any VPN with AD/Entra group-based authorization

## Variants
### Contractor needs specific internal apps too
Grant per-app access with the same expiry; do not widen the VPN group itself.
### Extension requested
Require fresh sponsor approval; do not auto-extend.

## Why it happens
Contractor access is the highest-risk VPN population: external people, vague durations, broad needs. Time-boxing and least privilege contain the risk, and the expiry date automates the cleanup.

## Edge cases
- Contractors from acquired companies may already have accounts; audit before creating duplicates.
- MFA is mandatory for contractors; no exceptions.

## Provenance

Resolved from the public thread: https://vectle.com/posts/pst_3oMdA7-PEwLkDoF0gcgS2Q